Re: [gentoo-dev] Can we get PIE on all SUID binaries by default, por favor?

[Matthew Thode]

On Tue, 31 Jan 2012 19:58:32 -0500
"Anthony G. Basile" <blueness@g.o> wrote:

> On 01/29/2012 02:14 PM, Mike Frysinger wrote:
> > On Saturday 28 January 2012 07:26:59 Anthony G. Basile wrote:
> >> I've run nbench on two amd64 systems both running the same kernel
> >> vanilla-3.2.2.
> > i don't think nbench is a good benchmark for this as it isn't
> > really testing what you think it's testing.  it's very good at
> > validating math support in the ISA/ABI, optimized compiler output,
> > and supplementary math implementations in libgcc.  PIE vs non-PIE
> > will still be able to multiply/divide in pretty much the same
> > amount of time.
>
> I know, but the problem is, what benchmark best approximates common
> every day use?  So I wrote the following which really hits the
> problem hard on x86:
>
> int modfac(int n)
> {
>      if(n==0) return 1;
>      return n * modfac(n-1);
> }
>
> int main()
> {
>      int i;
>      for( i = 0 ; i < 4096*4096 ; i++ ) modfac(4096);
>      return 0;
> }
>
> Using vanilla kernel 3.2.2, userland built with vanilla toolchain,
> gcc-4.5.3-r1, glibc-2.13-r4, binutils-2.21.1-r1, compiling my code
> simply as gcc -o test modfac.c, CFLAGS="-O2 -march=i686 -pipe" I get:
>
>   time -p ./test
> real 327.89
> user 327.72
> sys 0.00
>
> Keep everything else the same, even the same hardware, but switch to
> userland built with hardened gcc-4.5.3-r2 (not -r1 because of the bus
> error), I get:
>
>   time -p ./test
> real 629.68
> user 629.37
> sys 0.00
>
> The hardware is 8 x "Intel(R) Core(TM) i7 CPU 920  @ 2.67GHz" with 12
> GB ram.  That's nearly a factor of 2x but how often does one set up
> 4k stack frames in everyday use?
>
> >> So at least on amd64, I don't think that performance is ever an
> >> issue.
> > yes, most likely on systems where the PIC has hardware support in
> > the ISA, the performance hit on PIE is typically low.
> >
> >> I have yet to look at x86.
> > pretty sure this is going to be much more palpable.
> > -mike
>
>

Vanilla userland is simply a stage3 chroot amd64.

hardened kernel/userland
real    5m43.402s
user    5m42.510s
sys     0m0.002s

hardened kernel/vanilla gcc
real    5m29.271s
user    5m28.417s
sys     0m0.003s

hardened kernel/vanilla userland
real    5m29.495s
user    5m28.599s
sys     0m0.030s

vanilla all (disabled pax and grsec on hardened kernel, compiled kernel
with hardened gcc)
real    5m34.861s
user    5m33.981s
sys     0m0.001s

i686 cflag test, vanilla all
	CFLAGS="-O2 -march=i686 -pipe"
	gcc modfac.c -o vv-moddfac
real	5m42.171s
user	5m41.176s
sys	0m0.092s

CPU: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
RAM: 16G


-- 
Matthew Thode (prometheanfire)