5 ms·
It is commonly enabled for C++ compilers, but ASLR defends against attacks that Go code is not generally vulnerable to.
by mappu 6y ago
It is commonly enabled for C++ compilers, but ASLR defends against attacks that Go code is not generally vulnerable to.
- zaarn 6y agoI'm not sure if that is accurate, ASLR defends against quite a range of attacks that are the result of code execution, which AFAIK can still occur in Go, Rowhammer comes to mind here as a universal crack against languages. There is no downside to activating ASLR either, so I'm not sure why it isn't.
- swiley 6y agoDoes addr2line still work with ASLR? Because that could be a reason not to.
- zaarn 6y agoaddr2line works depending on the code and compiler/libc. Your libunwind may be able to output relativ code addresses, in which case addr2line will work if you use the stacktrace. GDB should handle this as well. If your c compiler doesn't support it you can just disable compiling PIEs which automatically disables ASLR but that should be reserved for debug builds.