Date: Tue, 26 Aug 2008 17:49:43 +1000 From: Andrew Reilly <andrew-freebsd@areilly.bpc-users.org> To: Matthew Macy <mat.macy@gmail.com> Cc: Ivan Voras <ivoras@freebsd.org>, freebsd-arch@freebsd.org Subject: Re: FreeBSD and DEP aka "NX bit"? Message-ID: <20080826074943.GB85357@duncan.reilly.home> In-Reply-To: <3c1674c90808231713x47e42de5oa9fc2f2f244d2e74@mail.gmail.com> References: <g8q8i5$s9g$2@ger.gmane.org> <3c1674c90808231713x47e42de5oa9fc2f2f244d2e74@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Aug 23, 2008 at 05:13:30PM -0700, Matthew Macy wrote: > On Sat, Aug 23, 2008 at 5:04 PM, Ivan Voras <ivoras@freebsd.org> wrote: > > I stumbled upon this Wikipedia page: > > http://en.wikipedia.org/wiki/Comparison_of_BSD_operating_systems#Security_features > > and it mentions NX bit is supported in FreeBSD. Is this true? Is it > > enabled by default? > > Yes. However, it is in the upper word so it only works with PAE or > amd64. "jemalloc" maps the heap NX and thread stacks are mapped NX. > The default process stack currently needs to be executable because > sigcode is placed at the start of the stack at the time of process > creation. Oh, I was looking into this a few months ago, and came to the conclusion that NX wasn't turned on at all. How do applications/languages that use JIT or other run-time code generation get around the non-executable heap? Just not use jemalloc? I've been using 7-STABLE on amd64 for a long time, and haven't noticed any problems with Java or SBCL lisp or PLT-scheme, all of which use JIT code generation (but probably neither use jemalloc?) Cheers, -- Andrew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080826074943.GB85357>