Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 07 Nov 2014 07:25:31 -0500
From: "Anthony G. Basile" <>
Subject: Re: fixing -fPIE + -fstack-protector-all

On 11/06/14 07:36, John Spencer wrote:
> Anthony G. Basile wrote:
>> On 11/05/14 10:43, Rich Felker wrote:
>>> However, this proposed solution breaks one odd corner case: static
>>> linking when all the source files were compiled with -fPIC or -fPIE.
>>> In that case, there would be no references to __stack_chk_fail, only
>>> to __stack_chk_fail_local, and thereby __init_ssp would not get
>>> linked, and a zero canary would be used.
>> I would rather not see this solution.
> why ?

I want to save that corner case.  In gentoo we compile everything 
pic/pie, even our executables:

# readelf -h /bin/bash  | grep Type:
   Type:                              DYN (Shared object file)

This randomizes even the address of main.  The following

#include <stdio.h>
int main() {
   printf("%p\n", main);



on successive runs when compiled with our default gcc specs.  Along with 
PaX's enhenced aslr this helps against brute forcing addresses.  Compare 
to when I turn off pie:


Having said that, currently we do not support *static* pic/pie in 
Gentoo, but I would really like to, especially with musl.  Also, I'm not 
as worried about the GOT for reasons I stated elsewhere.

Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.