Re: [gentoo-dev] Can we get PIE on all SUID binaries by default, por favor?

[Mike Frysinger]

On Tuesday 31 January 2012 19:58:32 Anthony G. Basile wrote:
> On 01/29/2012 02:14 PM, Mike Frysinger wrote:
> > On Saturday 28 January 2012 07:26:59 Anthony G. Basile wrote:
> >> I've run nbench on two amd64 systems both running the same kernel
> >> vanilla-3.2.2.
> >
> > i don't think nbench is a good benchmark for this as it isn't really
> > testing what you think it's testing.  it's very good at validating math
> > support in the ISA/ABI, optimized compiler output, and supplementary
> > math implementations in libgcc.  PIE vs non-PIE will still be able to
> > multiply/divide in pretty much the same amount of time.
>
> I know, but the problem is, what benchmark best approximates common
> every day use?  So I wrote the following which really hits the problem
> hard on x86:
>
> int modfac(int n)
> {
>      if(n==0) return 1;
>      return n * modfac(n-1);
> }
>
> int main()
> {
>      int i;
>      for( i = 0 ; i < 4096*4096 ; i++ ) modfac(4096);
>      return 0;
> }
>
> Using vanilla kernel 3.2.2, userland built with vanilla toolchain,
> gcc-4.5.3-r1, glibc-2.13-r4, binutils-2.21.1-r1, compiling my code
> simply as gcc -o test modfac.c, CFLAGS="-O2 -march=i686 -pipe" I get:
>
>   time -p ./test
> real 327.89
> user 327.72
> sys 0.00
>
> Keep everything else the same, even the same hardware, but switch to
> userland built with hardened gcc-4.5.3-r2 (not -r1 because of the bus
> error), I get:
>
>   time -p ./test
> real 629.68
> user 629.37
> sys 0.00
>
> The hardware is 8 x "Intel(R) Core(TM) i7 CPU 920  @ 2.67GHz" with 12 GB
> ram.  That's nearly a factor of 2x but how often does one set up 4k
> stack frames in everyday use?

you mean how often do people do recursion on data sets ?  is that 2x slow down 
really because of the *depth* of the stack ?
-mike