[ASLR] Better control on Randomization

[Emmanuel Fleury <emmanuel.fleury@labri.fr>]

Hi all,

I would like to have a way to enable/disable randomization of the stack
independently of the randomization of the dynamic library loading.

I mean, in recent Linux kernel, thanks to the ASLR, we have a
randomization of the stack:

[fleury@carioca programs]$ ./testASLR
str= 0xbf8e3a3c (/bin/sh), envp= 0xbf8e18ec, argv= 0xbf8e18e4
[fleury@carioca programs]$ ./testASLR
str= 0xbfedda3c (/bin/sh), envp= 0xbfedd75c, argv= 0xbfedd754
[fleury@carioca programs]$ ./testASLR
str= 0xbfe3ba3c (/bin/sh), envp= 0xbfe3a10c, argv= 0xbfe3a104

(testASLR just output the address of the envp and the argv variables).

And randomization of the dynamic library:
[fleury@carioca programs]$ cat /proc/self/maps | grep libc
b7e01000-b7f2e000 r-xp 00000000 03:02 328183     /lib/tls/libc-2.3.5.so
b7f2e000-b7f33000 r--p 0012d000 03:02 328183     /lib/tls/libc-2.3.5.so
b7f33000-b7f36000 rw-p 00132000 03:02 328183     /lib/tls/libc-2.3.5.so
[fleury@carioca programs]$ cat /proc/self/maps | grep libc
b7e59000-b7f86000 r-xp 00000000 03:02 328183     /lib/tls/libc-2.3.5.so
b7f86000-b7f8b000 r--p 0012d000 03:02 328183     /lib/tls/libc-2.3.5.so
b7f8b000-b7f8e000 rw-p 00132000 03:02 328183     /lib/tls/libc-2.3.5.so
[fleury@carioca programs]$ cat /proc/self/maps | grep libc
b7de4000-b7f11000 r-xp 00000000 03:02 328183     /lib/tls/libc-2.3.5.so
b7f11000-b7f16000 r--p 0012d000 03:02 328183     /lib/tls/libc-2.3.5.so
b7f16000-b7f19000 rw-p 00132000 03:02 328183     /lib/tls/libc-2.3.5.so

When setting /proc/sys/kernel/randomize_va_space to 0, both
randomization stop (see in linux/arch/i386/kernel/process.c).

Would it be possible to tweak them independently from each other ?
(still via procfs)

Regards
-- 
Emmanuel Fleury

The highest goal of computer science is to automate that
which can be automated.
  -- D. L. VerLee