看板FB_security
標 題Re: [CFT] ASLR, PIE, and segvguard on 11-current and 10-stable
發信站NCTU CS FreeBSD Server (Mon May 26 04:06:40 2014)
轉信站ptt!csnews.cs.nctu!news.cednctu!FreeBSD.cs.nctu!.POSTED!freebsd.org!ow
--Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=iso-8859-1
On 25 May 2014, at 19:42, Oliver Pinter <
[email protected]> wrote:
> On 5/25/14, Dag-Erling Sm=F8rgrav <[email protected]> wrote:
>> Oliver Pinter <
[email protected]> writes:
....
>>> PAX: blacklist clang and related binaries from PIE support
>>=20
>> Why? Performance, or do they actually break?
>=20
> No. If you definded WITH_CLANG_EXTRAS=3D in src.conf, the breaked the =
build.
> (added dim@ to CC)
>=20
> --- usr.bin.all__D ---
> =
/usr/obj/usr/data/source/git/opBSD/hardenedBSD.git/usr.bin/clang/bugpoint/=
.../../../lib/clang/libllvmirreader/libllvmirreader.a:
> could not read symbols: Bad value
> c++: error: linker command failed with exit code 1 (use -v to see =
invocation)
> *** [bugpoint] Error code 1
I assume you only get this with your ASLR patches applied? Maybe this =
is because the clang binary itself gets built statically (and so will =
definitely not be PIE), but the rest of the 'extras', such as bugpoint, =
are regular dynamic executables. And note that none of the libraries =
built under lib/libclang are built with -fPIC, at the moment. So that =
might cause trouble with your PIE patches.
In any case, the interesting thing is what the actual linker error was. =
Do you have more of the preceding build log, including the rest of the =
settings that were used to build world? And also, what does "file =
/usr/obj/usr/data/source/git/opBSD/hardenedBSD.git/usr.bin/clang/bugpoint/=
.../../../lib/clang/libllvmirreader/libllvmirreader.a" say?
-Dimitry
--Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename=signature.asc
Content-Type: application/pgp-signature;
name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
iEYEARECAAYFAlOCMTMACgkQsF6jCi4glqNQmQCgxsg9UC9JkSn8kNHnariVhESs
xa4An2oaJXR9EThhr5gpLZ9LjH907/rQ
=kgCZ
-----END PGP SIGNATURE-----
--Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E--