From owner-freebsd-current@FreeBSD.ORG  Sun May 25 17:23:55 2014
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 59B61316;
 Sun, 25 May 2014 17:23:55 +0000 (UTC)
Received: from smtp.des.no (smtp.des.no [194.63.250.102])
 by mx1.freebsd.org (Postfix) with ESMTP id 1A6B220E5;
 Sun, 25 May 2014 17:23:54 +0000 (UTC)
Received: from nine.des.no (smtp.des.no [194.63.250.102])
 by smtp-int.des.no (Postfix) with ESMTP id 52CE2A682;
 Sun, 25 May 2014 17:23:53 +0000 (UTC)
Received: by nine.des.no (Postfix, from userid 1001)
 id 65D2830FF4; Sun, 25 May 2014 19:23:53 +0200 (CEST)
From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no>
To: Oliver Pinter <oliver.pntr@gmail.com>
Subject: Re: [CFT] ASLR, PIE, and segvguard on 11-current and 10-stable
References: <20140514135852.GC3063@pwnie.vrt.sourcefire.com>
 <CAPjTQNG9pGLbDF7a8b+9s_NRD3Rq-sLnj7AXczjB=Ko_S44C3A@mail.gmail.com>
Date: Sun, 25 May 2014 19:23:53 +0200
In-Reply-To: <CAPjTQNG9pGLbDF7a8b+9s_NRD3Rq-sLnj7AXczjB=Ko_S44C3A@mail.gmail.com>
 (Oliver Pinter's message of "Sat, 24 May 2014 01:24:30 +0200")
Message-ID: <86a9a56ac6.fsf@nine.des.no>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: freebsd-security@freebsd.org, freebsd-current@freebsd.org,
 freebsd-stable@freebsd.org, Shawn Webb <lattera@gmail.com>
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 25 May 2014 17:23:55 -0000

Oliver Pinter <oliver.pntr@gmail.com> writes:
>       PAX LOG: implement new logging subsystem
>       PAX LOG: fix pax_ulog_segvguard
>       PAX LOG: added sysctl's and tunables
>       PAX ASLR: use PAX LOG
>       PAX LOG: fix pax_ulog_##name()
>       PAX LOG: fix prison init
>       PAX LOG: fixed log and ulog sysctl

What exactly is the purpose of PAX LOG?  Have you considered using
ktrace instead?

>       PAX: blacklist clang and related binaries from PIE support

Why?  Performance, or do they actually break?

>       PAX ASLR: Blacklist the applications that don't support being built=
 as a position-independent executable

"don't support" as in you have tested them and confirmed that they break
in some way?  Could you post your test methodology so people can
replicate the failures and look into fixing them?

>       PAX ASLR: Use a full kernel config for LATT-ASLR

What is the difference between LATT-ASLR and OP-ASLR, and why not just
"include GENERIC"?  You know about "nooptions", right?

>       Revert "PAX: blacklist clang and related binaries from PIE support"
>       Revert "Revert "PAX: blacklist clang and related binaries from PIE =
support""

Hmm...

DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no