Re: [gentoo-hardened] Problems emerging glibc-2.3.4.20040619 related to __guard and __stack_smash_handler

> So, what is the right way to add SSP to everything (including the kernel)
> for Gentoo with a 2.6.7+ kernel, without adding Pax ASLR?

ssp and ASLR are different animals, you can use one independently of
the other. adding ssp should be automatic when you have a gcc emerged
with the hardened USE flag, adding it to the kernel is pointless as
things stand now (maybe pappy has more info on how our suggestions
to Mr. Etoh progressed since).
  
> The last time I tried a full Gentoo system with ASLR enabled (several
> months ago), gdb didn't work on PHP .. a big problem for me.

are you sure it wasn't caused by the non-exec page enforcement instead
(which prevents gdb from setting breakpoints)?

> So the code segments for the shared libraries really are shared when
> using 2.6.x with Pax ASLR?

it's all independent of PaX or the kernel version, what really matters is
whether the shared libs have text relocations or not. normally compiling
with -fPIC ensures that they do not, but there are some special libs that
for one reason or another contain assembly code and/or are improperly
compiled and end up with text relocations. the hardened gentoo subproject
is actually trying to get rid of these so that a PaX feature can be enabled
that forbids text relocations from the kernel itself (this is because text
relocations are a way to generate code at runtime and hence a potential
exploit method).

> If prelink brings so little memory savings over Pax ASLR, then why would
> anyone want to use prelink instead of Pax ASLR on a server?

they solve different problems, prelink speeds up runtime linking, it has
nothing/little to do with saving memory. ASLR randomizes the address
space layout to make certain exploits fail with a high probability.
most likely on a server you want every bit of security vs. the small
speedup in application startup time.

> Prelink also can only randomize the start address of shared libraries,

that's not the same kind of randomization as ASLR, it is not per execution
but 'whenever you run prelink'. for this reason it's a pretty pointless
feature in prelink (considering how people are running prelink from the
daily cron, you have more than enough time to brute force the entropy).

> not the code segment for the binary in question - unlink ASLR, right?

well, i think it depends on the kind of executables you have, probably
PIEs can also be prelinked, although i never checked/tried myself. PIEs
are the ET_DYN ELF executables that are easiest to randomize and what you
also get in hardened gentoo by default. ASLR can also randomize the more
traditional ET_EXEC ELF executables but that feature has drawbacks and
we're not encouraging its use, but it serves as a good proof-of-concept.


--
gentoo-hardened@g.o mailing list