Gentoo Archives: gentoo-security

From: Armando Di Cianno <adicianno@×××××××××.com>
To: pageexec@××××××××.hu
Cc: solar@g.o, discuss-gnustep@×××.org, gentoo-security@l.g.o
Subject: Re: [Fwd: [gentoo-security] pax and objc]
Date: Thu, 01 Jul 2004 20:03:12
Message-Id: 6494de10d623f43b628498bfc68915a2@mudra
1 As the original sender of these issues and questions, I'd like to
2 clarify and relate what information I've collected, as to not waste
3 anyone else's brain processes.
5 The confusion I was facing was that I could not nail down the exact
6 isses that some people posed to me. The issue existed somewhere
7 among:
8 - PaX
9 - libffi -or- ffcall
10 - GNUstep core libraries
12 The first I heard of the issue was here:
14 ... and at that point started my procession to nail this down.
16 I also have a report from a user using gcc-3.3.3 (on gentoo) that
17 installing libffi, and not ffcall, let his by-hand GNUstep install
18 work, whereas ffcall would trigger PaX. Likely, this is because of
19 mprotect() use in ffcall. However, ffcall, according to Lv on
20 #gentoo-dev, isn't 64-bit safe, so libffi should probably e used
21 dominantly at the moment, anyway.
23 On 2004-07-01 14:49:08 -0400 pageexec@××××××××.hu wrote:
24 > ffcall seems to implement trampolines which suggests to me that it
25 > requires runtime code generation and probably GNUstep does make use
26 > of that feature. it is fundamentally incompatible with PaX so the
27 > solution is to either rewrite GNUstep to not need runtime code
28 > generation
29 Uhmm. I think this is the first honest case of "it's a feature, not a
30 bug" that I've ever seen. I haven't looked at the libobjc source in
31 gcc, ever, but I'm going to take an educated guess and say that I
32 believe the runtime generation of code allows it to do run-time
33 introspection and execution that simply isn't possible to create a
34 structure for at compile time. Objective-C is a compiled language,
35 but retains a lot of it's SmallTalk inspired design.
37 Having said all this, AFAIK, libffi (giving up on ffcall at the
38 moment) is the spot where trouble with security features like PaX is
39 going to exist. If this is the case, is there anyone out there that
40 can confirm or deny this?
42 Thanks for all the respones.
44 __Armando Di Cianno
47 --
48 gentoo-security@g.o mailing list