5 ms·

I have to agree. I'm reminded of OpenBSD's move in 6.0 to enforce W^X on binaries. This breaks the use of my cooperative threading library: in order to avoid r

• deaddodo 10y ago
  HardenedBSD[1] is FreeBSD pre-hardened. This is one of the few times I agree with a parallel sister project over multi-paradigm design, since they make pretty significant changes to the Kernel+World[2] that aren't necessarily beneficial to home users. 1 - https://hardenedbsd.org/ https://hardenedbsd.org/ 2 - https://hardenedbsd.org/content/freebsd-and-hardenedbsd-feature-comparisons https://hardenedbsd.org/content/freebsd-and-hardenedbsd-feat...
• danieldk 10y ago
  What I would like to see FreeBSD do to help with migrating to stronger security is something like "freebsd-harden" that you run once after a new installation or version upgrade, and it will walk you through a series of yes/no prompts, and advise, "if you aren't sure, say no." Actually, they now have such a post-install script: https://reviews.freebsd.org/D6826 https://reviews.freebsd.org/D6826 https://wiki.freebsd.org/WhatsNew/FreeBSD11#Security https://wiki.freebsd.org/WhatsNew/FreeBSD11#Security
  • byuu 10y ago
    Very cool! And I can use this menu over a VPS SSH session (so no color support) after the initial install? Usually I think of bsdinstall as being run pre-install, not post-install.
• JoshTriplett 10y ago
  (Note: I agree with your main point that changing defaults can cause problems, and security needs to balance with usability or people won't use it.) For that 50-byte block of code, on most platforms, you could tell the compiler or linker to put it in the text section directly along with the rest of the code, rather than in the data section. A linker script or a section attribute can do that. Then you can just call it using the appropriate symbol. I just tested this, with a manually assembled array of bytes, using both of those methods, and both of them work. Here's the linker script approach: /tmp$ cat main.c unsigned long long add(unsigned long long, unsigned long long); int main(void) { return add(23, 45); } /tmp$ cat add.c unsigned char add[] = { 0x48, 0x89, 0xf8, /* mov %rdi,%rax */ 0x48, 0x01, 0xf0, /* add %rsi,%rax */ 0xc3, /* retq */ }; /tmp$ cat demo.ld SECTIONS { .text : { main.o(.text); add.o(.data); } } /tmp$ gcc -c main.c -o main.o /tmp$ gcc -c add.c -o add.o /tmp$ gcc demo.ld -o demo /tmp$ ./demo ; echo $? 68 While this won't work on every possible platform, in practice it'll work for almost any platform you might care about.
  • byuu 10y ago
    Wow, that's very neat! Thank you! Does Clang support this as well? It looks like I don't need the main.o(.text) line either, which is good because that would be a large burden on users of the library. Also, just noting for others, I had to use .text : { libco.o(.rdata); } since my char array was const.
    • pdw 10y ago
      The attribute approach seems a lot more convenient: const unsigned char add[] __attribute__((section("text"))) = { 0x48, 0x89, 0xf8, /* mov %rdi,%rax */ 0x48, 0x01, 0xf0, /* add %rsi,%rax */ 0xc3, /* retq */ };
      • byuu 10y ago
        Interesting ... with section("text"), it crashes. With section(".text"), it works, but spews out this: <gibberish>.s: Assembler messages: <gibberish>.s:155: Warning: Ignoring changed section attributes for .text However, it does compile and work :/
• restalis 10y ago
  "in order to avoid requiring specific compilers/assemblers, I use ~50 bytes of pre-compiled code so that it'll compile anywhere" That is a rather odd conclusion. The pre-compiled code is supposed to be a worse solution than having assembler bits.
  • byuu 10y ago
    Yeah, I take a lot of flack from this from other people. But I'm sorry; I'm not going to write the code in GNU as (and that godawful AT&T syntax) or nasm/yasm (and require another tool to build the library), require a second compiled object for the library, and lose compatibility with Visual C++ and Clang. Also, apologies to HN. I wasn't trying to turn this into a "help me with my problem" discussion. I was just pointing out how adding extra security can have unintended consequences to other applications with an actual example.
    • myst 10y ago
      What's wrong with AT&T syntax? Anyway, better than 50-byte binary blob.
• bonzini 10y ago
  > I use ~50 bytes of pre-compiled code so that it'll compile anywhere. To do that, I have to mark the block R|X. Memory is cheap; mmap 4K of R|W RAM, copy the code, and mprotect it to R|X.
  • byuu 10y ago
    That turns the address from a compile-time constant into a pointer. This function is used tens of millions of times a second, so that cost would add up. I covered this in my initial post, though :/
    • bonzini 10y ago
      On glibc you could use ifunc to patch the address at run-time.