TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

W^X now mandatory in OpenBSD

240 点作者 fcambus将近 9 年前

9 条评论

near将近 9 年前
I&#x27;ve always been in favor of all OpenBSD security enhancements I&#x27;ve seen, but I have to say, and please hear me out, this is an objectively terrible idea.<p>Yes, most programs should disallow W|X by default. But trying to banish the entire practice with a mount flag, knowing full well few people will go that far to run a W|X application, is bad practice. I&#x27;d rather see this as another specialty chmod flag ala SUID, SGID, etc. Or something along those lines. One shouldn&#x27;t have to enable filesystem-wide W|X just to run one application.<p>The thing is, when you actually <i>do</i> need W|X, there is no simple workaround. Many emulators and JITs <i>need</i> to be able to dynamically recompile instructions to native machine code to achieve acceptable performance (emulating a 3GHz processor is just not going to happen with an interpreter.) For a particularly busy dynamic recompiler, having to constantly call mprotect to toggle the page flags between W!X and X!W will impact performance too greatly, since that is a syscall requiring a kernel-level transition.<p>We also have app stores banning the use of this technique as well. This is a very troubling trend lately; it is throwing the baby out with the bathwater.<p>EDIT: tj responded to me on Twitter: &quot;the per-mountpoint idea is just an initial method; it&#x27;ll be refined as time goes on. i think per-binary w^x is in the pipeline.&quot; -- that will not only resolve my concerns, but in fact would be my ideal design to balance security and performance.
评论 #11790308 未加载
评论 #11790007 未加载
评论 #11798659 未加载
评论 #11790185 未加载
评论 #11791984 未加载
cranium将近 9 年前
For those heading into the comments to know what this is about: W^X is a protection policy on memory with the effect that every page in memory can either be written or executed but not both simultaneously (Write XOR eXecute). It can prevent, for example, some buffer overflow attacks.
评论 #11789488 未加载
评论 #11789806 未加载
sillysaurus3将近 9 年前
This paper&#x27;s thesis is that W^X does not work, and not because of any of the reasons presented in this thread: <a href="https:&#x2F;&#x2F;cseweb.ucsd.edu&#x2F;~hovav&#x2F;dist&#x2F;geometry.pdf" rel="nofollow">https:&#x2F;&#x2F;cseweb.ucsd.edu&#x2F;~hovav&#x2F;dist&#x2F;geometry.pdf</a><p>The paper says that to bypass W^X protection, you can simply scan an executable for &quot;the instruction you want to use, followed by a RET&quot;. The paper calls these &quot;gadgets.&quot;<p>You can write any function you want by using these gadgets: simply call them. When you call a gadget, it executes the corresponding instruction, then returns. This allows you to write arbitrary functions, since real-world programs are large enough that they have a massive number of gadgets for you to choose from.<p>Can someone provide a counterargument?
评论 #11789875 未加载
评论 #11789929 未加载
评论 #11789881 未加载
评论 #11789850 未加载
评论 #11795926 未加载
评论 #11789879 未加载
jtchang将近 9 年前
Does this mean to successfully exploit a program I need to write to an area in memory that the program will later turn the page in memory to &quot;Execute&quot;?
评论 #11789844 未加载
评论 #11789578 未加载
nightcracker将近 9 年前
What about JIT compilation and other forms of code generation?
评论 #11789921 未加载
评论 #11789654 未加载
bch将近 9 年前
NetBSD is going through some similar security moves currently (extending PaX[0]), and iiuc, there are special considerations required for Java&#x2F;jvm, because of the bytecoding process. Does anybody know if my understanding is correct (that a page will have to be both writable and executable) and if so, what are OpenBSDs considerations for this ?<p>[0] <a href="http:&#x2F;&#x2F;mail-index.netbsd.org&#x2F;current-users&#x2F;2016&#x2F;05&#x2F;15&#x2F;msg029374.html" rel="nofollow">http:&#x2F;&#x2F;mail-index.netbsd.org&#x2F;current-users&#x2F;2016&#x2F;05&#x2F;15&#x2F;msg029...</a>
评论 #11789569 未加载
评论 #11791674 未加载
malkia将近 9 年前
I dunno why, but this quote from Benjamin Fraklin came to m mind - “Those who surrender freedom for security will not have, nor do they deserve, either one.”<p>i&#x27;m just kiddin ;)
fithisux将近 9 年前
Can someone provide an introduction for dummies like me?
评论 #11791084 未加载
anfroid555将近 9 年前
Anyone know if Erlang is good?
评论 #11798579 未加载