Re: fixing -fPIE + -fstack-protector-all

["Anthony G. Basile" <basile@opensource.dyc.edu>]

On 11/06/14 07:36, John Spencer wrote:
> Anthony G. Basile wrote:
>> On 11/05/14 10:43, Rich Felker wrote:
>>> However, this proposed solution breaks one odd corner case: static
>>> linking when all the source files were compiled with -fPIC or -fPIE.
>>> In that case, there would be no references to __stack_chk_fail, only
>>> to __stack_chk_fail_local, and thereby __init_ssp would not get
>>> linked, and a zero canary would be used.
>>
>> I would rather not see this solution.
>>
>
> why ?

I want to save that corner case.  In gentoo we compile everything 
pic/pie, even our executables:

# readelf -h /bin/bash  | grep Type:
   Type:                              DYN (Shared object file)

This randomizes even the address of main.  The following

#include <stdio.h>
int main() {
   printf("%p\n", main);
}

yields

0x61f64b845
0x33fa0b7845
0x189ab51845
0x58531cd845

on successive runs when compiled with our default gcc specs.  Along with 
PaX's enhenced aslr this helps against brute forcing addresses.  Compare 
to when I turn off pie:

0x400605
0x400605
0x400605

Having said that, currently we do not support *static* pic/pie in 
Gentoo, but I would really like to, especially with musl.  Also, I'm not 
as worried about the GOT for reasons I stated elsewhere.


-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197