Date: Fri, 05 Dec 2014 20:30:55 -0500 From: Daniel Micay <danielmicay@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Re: Offset2lib: bypassing full ASLR on 64bit Linux On 05/12/14 08:18 PM, Andy Lutomirski wrote: > On 12/05/2014 04:44 PM, Hanno Böck wrote: >> On Fri, 05 Dec 2014 17:43:44 -0500 >> Daniel Kahn Gillmor <dkg-QLrU/DhXBlmnlhUoGqYIEF6hYfS7NtTn@...lic.gmane.org> wrote: >> >>> i couldn't find a reference to this in the nautilus bugtracker, so i >>> just posted: >>> >>> https://bugzilla.gnome.org/show_bug.cgi?id=741183 >> >> I tried to dig into this a bit. I'm not really sure, but based on the >> output I assume nautilus is relying on file or libmagic to assess the >> file type. >> >> And that's what fails: >> $ file --mime-type pie >> pie: application/x-sharedlib >> >> >> It seems there is no really easy way to separate executables from >> shared libraries and whether this should be considered a bug in >> file/libmagic. The only thing I quickly found that would be possible is >> searching if a SONAME is present. libmagic uses some "magic" file >> format to parse files, I don't know if that's capable of such complex >> parsing. >> > > Why does gcc and/or ld write a non-zero entry point? If they didn't, > that would be an easy way to check. > > --Andy There are some libraries like glibc's /usr/lib/libc.so.6 with valid entry points, so file would still have trouble disambiguating that way. I don't really think this is a problem for libmagic/file to solve, if it's really a problem at all. Nautilus could just remove support for executing traditional executables too... using CLI utilities that way isn't going to work out and GUI ones have desktop files. Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.