2006-10-20 11:55:30

by Marcus Meissner

Subject: [PATCH] binfmt_elf: randomize PIE binaries (2nd try)

Randomizes -pie compiled binaries from PAGE_SIZE up to
ELF_ET_DYN_BASE.

0 -> PAGE_SIZE is excluded to allow NULL ptr accesses
to fail.

Signed-off-by: Marcus Meissner <[email protected]>

----
binfmt_elf.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

--- linux-2.6.18/fs/binfmt_elf.c.xx 2006-10-20 10:42:03.000000000 +0200
+++ linux-2.6.18/fs/binfmt_elf.c 2006-10-20 10:51:27.000000000 +0200
@@ -856,7 +856,13 @@
* default mmap base, as well as whatever program they
* might try to exec. This is because the brk will
* follow the loader, and is not movable. */
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ if (current->flags & PF_RANDOMIZE)
+ load_bias = randomize_range(PAGE_SIZE,
+ ELF_ET_DYN_BASE,
+ 0);
+ else
+ load_bias = ELF_ET_DYN_BASE;
+ load_bias = ELF_PAGESTART(load_bias - vaddr);
}

error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,

2006-10-20 12:20:34

by Jesper Juhl

Subject: Re: [PATCH] binfmt_elf: randomize PIE binaries (2nd try)

On 20/10/06, Marcus Meissner <[email protected]> wrote:
> Randomizes -pie compiled binaries from PAGE_SIZE up to
> ELF_ET_DYN_BASE.
>
> 0 -> PAGE_SIZE is excluded to allow NULL ptr accesses
> to fail.
>
> Signed-off-by: Marcus Meissner <[email protected]>
>
> ----
> binfmt_elf.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> --- linux-2.6.18/fs/binfmt_elf.c.xx 2006-10-20 10:42:03.000000000 +0200
> +++ linux-2.6.18/fs/binfmt_elf.c 2006-10-20 10:51:27.000000000 +0200
> @@ -856,7 +856,13 @@
> * default mmap base, as well as whatever program they
> * might try to exec. This is because the brk will
> * follow the loader, and is not movable. */
> - load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
> + if (current->flags & PF_RANDOMIZE)
> + load_bias = randomize_range(PAGE_SIZE,
> + ELF_ET_DYN_BASE,
> + 0);

How about putting the two lines above on one line? ^^^^^

> + ELF_ET_DYN_BASE, 0);


--
Jesper Juhl <[email protected]>
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please http://www.expita.com/nomime.html

2006-10-20 12:32:35

by Marcus Meissner

Subject: Re: [PATCH] binfmt_elf: randomize PIE binaries (2nd try)

On Fri, Oct 20, 2006 at 02:20:31PM +0200, Jesper Juhl wrote:
> On 20/10/06, Marcus Meissner <[email protected]> wrote:
> >Randomizes -pie compiled binaries from PAGE_SIZE up to
> >ELF_ET_DYN_BASE.
> >
> >0 -> PAGE_SIZE is excluded to allow NULL ptr accesses
> >to fail.
> >
> >Signed-off-by: Marcus Meissner <[email protected]>
> >
> >----
> > binfmt_elf.c | 8 +++++++-
> > 1 file changed, 7 insertions(+), 1 deletion(-)
> >
> >--- linux-2.6.18/fs/binfmt_elf.c.xx 2006-10-20 10:42:03.000000000 +0200
> >+++ linux-2.6.18/fs/binfmt_elf.c 2006-10-20 10:51:27.000000000 +0200
> >@@ -856,7 +856,13 @@
> > * default mmap base, as well as whatever program
> > they
> > * might try to exec. This is because the brk will
> > * follow the loader, and is not movable. */
> >- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
> >+ if (current->flags & PF_RANDOMIZE)
> >+ load_bias = randomize_range(PAGE_SIZE,
> >+
> >ELF_ET_DYN_BASE,
> >+ 0);
>
> How about putting the two lines above on one line? ^^^^^

My editor said it would end at column 80. Starting from 0 it would col 79
actually, but I did not want to risk it.

Ciao, Marcus