Re: 2.6.12-rc3 mmap lack of consistency among runs

[Hubert Tonneau <hubert.tonneau@fullpliant.org>]

Arjan van de Ven wrote:
>
> > You can disable randomization on a per-executable basis by setting an ELF
> > personality.  I forget the magic incantation.  Arjan?
> 
> setarch -R

I had no success with it:
/usr/src/setarch-1.7/setarch i386 -R /pliant/fullpliant

I even tried adding the following instruction at the very beginning of my
C program, with no more success:
personality(0x0040000); // ADDR_NO_RANDOMIZE

Basically, the behaviour is not changed, as opposed to if I do:
echo 0 >/proc/sys/kernel/randomize_va_space

> > . second, my process restart succeeding roughly in 50% cases means that the
> >   randomisation performed is just a toy. A virus assuming fixed memory layout
> >   will still succeed 50% of times to install.
> 
> It just means that half the time the old value was below the current
> boundary, and half the time above. Eg half the time it was in free
> space and you succeeded but left a gap, the other half there was a conflict.
> Says nothing about the value of randomisation...

Understood.

> > All in all, I'm not concerned about Linux kernel to randomise or not,
> > but I need to have a reliable way to request a memory region and be granted
> > that I can request the same one in a futur run.
> > What is the proper way to get such a memory area ?
>  
> > MAP_FIXED?
> 
> MAP_FIXED is generally a really bad idea though.

If I replace
  PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0
with
  PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0
the call just fails.