Thread (39 messages) 39 messages, 10 authors, 2018-04-03

Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.

From: Ilya Smith <hidden>
Date: 2018-03-30 11:10:21
Also in: linux-alpha, linux-mips, linux-mm, linux-s390, linux-sh, lkml, sparclinux

On 30 Mar 2018, at 12:57, Pavel Machek [off-list ref] wrote:
=20
On Fri 2018-03-30 12:07:58, Ilya Smith wrote:
quoted
Hi
=20
quoted
On 30 Mar 2018, at 10:55, Pavel Machek [off-list ref] wrote:
=20
Hi!
=20
quoted
Current implementation doesn't randomize address returned by mmap.
All the entropy ends with choosing mmap_base_addr at the process
creation. After that mmap build very predictable layout of address
space. It allows to bypass ASLR in many cases. This patch make
randomization of address on any mmap call.
=20
How will this interact with people debugging their application, and
getting different behaviours based on memory layout?
=20
strace, strace again, get different results?
=20
=20
Honestly I=E2=80=99m confused about your question. If the only one =
way for debugging=20
quoted
application is to use predictable mmap behaviour, then something went =
wrong in=20
quoted
this live and we should stop using computers at all.
=20
I'm not saying "only way". I'm saying one way, and you are breaking
that. There's advanced stuff like debuggers going "back in time".
=20
Correct me if I wrong, when you run gdb for instance and try to debug =
some=20
application, gdb will disable randomization. This behaviour works with =
gdb=20
command: set disable-randomization on. As I know, gdb remove flag =
PF_RANDOMIZE=20
from current personality thats how it disables ASLR for debugging =
process.=20
According to my patch, flag PF_RANDOMIZE is checked before calling=20
unmapped_area_random. So I don=E2=80=99t breaking debugging. If you =
talking about the=20
case, when your application crashes under customer environment and you =
want to
debug it; in this case layout of memory is what you don=E2=80=99t =
control at all and=20
you have to understand what is where. So for debugging memory process =
layout is
not what you should care of.

Thanks,
Ilya
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help