[RFC] Enable nxstack by default
Jeremie Le Hen
jeremie at le-hen.org
Tue Nov 15 16:58:05 UTC 2011
Hi,
On Wed, Oct 19, 2011 at 12:37:44AM +0200, Oliver Pinter wrote:
> In NetBSD has been some PaX feature [0] implemented. (ASLR, W^X
> (~nxstack), mprotect restriction, veriexec, mmap randomization[2]...)
>
> [0] http://pax.grsecurity.net/docs/index.html
> [1] http://www.netbsd.org/~elad/recent/man/security.8.html
> [2] http://people.freebsd.org/~ssouhlal/testing/stackgap-20050527.diff
Suleiman actually wrought two patches, one randomizing the stack (the
one you pointed out) and another one randomizing non-fixed mmap(2)
calls:
http://people.freebsd.org/~ssouhlal/testing/mmap_random-20050528.diff
FYI, they do not apply cleanly on recent source trees (the patches were
made in 2005), but they can be applied with little fiddling. I'm
running multiple 8.x production machines with them without any problem.
I've always wanted them to be committed as opt-in knobs, but I can't
remember why they hadn't at the time.
Cheers,
--
Jeremie Le Hen
Men are born free and equal. Later on, they're on their own.
Jean Yanne
More information about the freebsd-current
mailing list