[PATCH] binfmt_elf: randomize PIE binaries (2nd try)

[PATCH] binfmt_elf: randomize PIE binaries (2nd try)

[Marcus Meissner]

Randomizes -pie compiled binaries from PAGE_SIZE up to
ELF_ET_DYN_BASE.

0 -> PAGE_SIZE is excluded to allow NULL ptr accesses
to fail.

Signed-off-by: Marcus Meissner <meissner@suse.de>

----
 binfmt_elf.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- linux-2.6.18/fs/binfmt_elf.c.xx	2006-10-20 10:42:03.000000000 +0200
+++ linux-2.6.18/fs/binfmt_elf.c	2006-10-20 10:51:27.000000000 +0200
@@ -856,7 +856,13 @@
 			 * default mmap base, as well as whatever program they
 			 * might try to exec.  This is because the brk will
 			 * follow the loader, and is not movable.  */
-			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+			if (current->flags & PF_RANDOMIZE)
+				load_bias = randomize_range(PAGE_SIZE,
+							    ELF_ET_DYN_BASE,
+							    0);
+			else
+				load_bias = ELF_ET_DYN_BASE;
+			load_bias = ELF_PAGESTART(load_bias - vaddr);
 		}
 
 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,

Re: [PATCH] binfmt_elf: randomize PIE binaries (2nd try)

[Jesper Juhl]

On 20/10/06, Marcus Meissner <meissner@suse.de> wrote:
> Randomizes -pie compiled binaries from PAGE_SIZE up to
> ELF_ET_DYN_BASE.
>
> 0 -> PAGE_SIZE is excluded to allow NULL ptr accesses
> to fail.
>
> Signed-off-by: Marcus Meissner <meissner@suse.de>
>
> ----
>  binfmt_elf.c |    8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> --- linux-2.6.18/fs/binfmt_elf.c.xx     2006-10-20 10:42:03.000000000 +0200
> +++ linux-2.6.18/fs/binfmt_elf.c        2006-10-20 10:51:27.000000000 +0200
> @@ -856,7 +856,13 @@
>                          * default mmap base, as well as whatever program they
>                          * might try to exec.  This is because the brk will
>                          * follow the loader, and is not movable.  */
> -                       load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
> +                       if (current->flags & PF_RANDOMIZE)
> +                               load_bias = randomize_range(PAGE_SIZE,
> +                                                           ELF_ET_DYN_BASE,
> +                                                           0);

How about putting the two lines above on one line?  ^^^^^

> +                                                           ELF_ET_DYN_BASE, 0);


-- 
Jesper Juhl <jesper.juhl@gmail.com>
Don't top-post  http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please      http://www.expita.com/nomime.html

Re: [PATCH] binfmt_elf: randomize PIE binaries (2nd try)

[Marcus Meissner]

On Fri, Oct 20, 2006 at 02:20:31PM +0200, Jesper Juhl wrote:
> On 20/10/06, Marcus Meissner <meissner@suse.de> wrote:
> >Randomizes -pie compiled binaries from PAGE_SIZE up to
> >ELF_ET_DYN_BASE.
> >
> >0 -> PAGE_SIZE is excluded to allow NULL ptr accesses
> >to fail.
> >
> >Signed-off-by: Marcus Meissner <meissner@suse.de>
> >
> >----
> > binfmt_elf.c |    8 +++++++-
> > 1 file changed, 7 insertions(+), 1 deletion(-)
> >
> >--- linux-2.6.18/fs/binfmt_elf.c.xx     2006-10-20 10:42:03.000000000 +0200
> >+++ linux-2.6.18/fs/binfmt_elf.c        2006-10-20 10:51:27.000000000 +0200
> >@@ -856,7 +856,13 @@
> >                         * default mmap base, as well as whatever program 
> >                         they
> >                         * might try to exec.  This is because the brk will
> >                         * follow the loader, and is not movable.  */
> >-                       load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
> >+                       if (current->flags & PF_RANDOMIZE)
> >+                               load_bias = randomize_range(PAGE_SIZE,
> >+                                                           
> >ELF_ET_DYN_BASE,
> >+                                                           0);
> 
> How about putting the two lines above on one line?  ^^^^^

My editor said it would end at column 80. Starting from 0 it would col 79
actually, but I did not want to risk it.

Ciao, Marcus