3 ms·

Plain, simple and effective as always! The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :) Makefile.relink: cc -o sshd `echo ${

Plain, simple and effective as always! The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :) Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd https://github.com/openbsd/src/commit/898412097f87ba70d4012f7a2e827f59719c659d#diff-cd8659908f01fc079dcdbc809d4b57f813b634420b0f7d8a3533258e23f122b6 https://github.com/openbsd/src/commit/898412097f87ba70d4012f...

viraptor 4y ago
Ah, so that will have some features of ASLR missing. Specifically, you can't do this on a read only root and it didn't randomise the stack location as far as I can tell?
- kryptiskt 4y ago
  Wouldn't the stack location be set at runtime and given by the stack register at the entry point?
  - viraptor 4y ago
    I think I've got a better idea now. So openbsd has ASLR which affects data, code/library, and stack positions. Then this solution works on top of it by reordering symbols within the code. One thing I'm still not sure about is whether the kernel could theoretically do the same reordering at load time using relocatable symbols.
    - actionfromafar 4y ago
      Sounds like Amiga HUNK format with the HUNK_OVERLAY hunk. For instance various functions could be loaded anywhere in memory.
    - saagarjha 4y ago
      The kernel needs a bit more information than that, since chunks of code can refer to each other and if you rearrange them this would break these since they're typically emitted as relative offsets.
    - wyldfire 4y ago
      The assembler laid out the code within the sections and generally it's not changed after that (except for targets that do linker relaxation). However with -ffunction-sections the compiler would put each function in its own section which then can be independently relocated.
      - KMag 4y ago
        If each function is in its own section, then all function calls would need to be indirected through the PLT/GOT, even function calls within the same translation unit? Ouch.
        wyldfire 4y ago
        No - the linker is there to resolve references among sections and can do so without PLT/GOT indirection when creating things like static archives. There may be a code size cost in some architectures - that since the call destination can be relocated far from the call site that the assembler will need to make sure it allocates enough space to reach the call target instead of a small PCREL relocation.
- codesniperjoe 4y ago
  For this new feature you pay indeed with the need for r/w and executable tmpfs/overlay somewhere. This does not replace classic ASLR: OpenBSD 5.7 activated position-independent static binaries (Static-PIE) by default. https://en.wikipedia.org/wiki/Address_space_layout_randomization#OpenBSD https://en.wikipedia.org/wiki/Address_space_layout_randomiza...

viraptor 4y ago

Ah, so that will have some features of ASLR missing. Specifically, you can't do this on a read only root and it didn't randomise the stack location as far as I can tell?

kryptiskt 4y ago
Wouldn't the stack location be set at runtime and given by the stack register at the entry point?
- viraptor 4y ago
  I think I've got a better idea now. So openbsd has ASLR which affects data, code/library, and stack positions. Then this solution works on top of it by reordering symbols within the code. One thing I'm still not sure about is whether the kernel could theoretically do the same reordering at load time using relocatable symbols.
  - actionfromafar 4y ago
    Sounds like Amiga HUNK format with the HUNK_OVERLAY hunk. For instance various functions could be loaded anywhere in memory.
  - saagarjha 4y ago
    The kernel needs a bit more information than that, since chunks of code can refer to each other and if you rearrange them this would break these since they're typically emitted as relative offsets.
  - wyldfire 4y ago
    The assembler laid out the code within the sections and generally it's not changed after that (except for targets that do linker relaxation). However with -ffunction-sections the compiler would put each function in its own section which then can be independently relocated.
    - KMag 4y ago
      If each function is in its own section, then all function calls would need to be indirected through the PLT/GOT, even function calls within the same translation unit? Ouch.
      - wyldfire 4y ago
        No - the linker is there to resolve references among sections and can do so without PLT/GOT indirection when creating things like static archives. There may be a code size cost in some architectures - that since the call destination can be relocated far from the call site that the assembler will need to make sure it allocates enough space to reach the call target instead of a small PCREL relocation.
codesniperjoe 4y ago
For this new feature you pay indeed with the need for r/w and executable tmpfs/overlay somewhere. This does not replace classic ASLR: OpenBSD 5.7 activated position-independent static binaries (Static-PIE) by default. https://en.wikipedia.org/wiki/Address_space_layout_randomization#OpenBSD https://en.wikipedia.org/wiki/Address_space_layout_randomiza...