[RFC] Enable nxstack by default

Jeremie Le Hen jeremie at le-hen.org
Tue Nov 15 16:58:05 UTC 2011


On Wed, Oct 19, 2011 at 12:37:44AM +0200, Oliver Pinter wrote:
> In NetBSD has been some PaX feature [0] implemented. (ASLR, W^X
> (~nxstack), mprotect restriction, veriexec, mmap randomization[2]...)
> [0] http://pax.grsecurity.net/docs/index.html
> [1] http://www.netbsd.org/~elad/recent/man/security.8.html
> [2] http://people.freebsd.org/~ssouhlal/testing/stackgap-20050527.diff

Suleiman actually wrought two patches, one randomizing the stack (the
one you pointed out) and another one randomizing non-fixed mmap(2)


FYI, they do not apply cleanly on recent source trees (the patches were
made in 2005), but they can be applied with little fiddling.  I'm
running multiple 8.x production machines with them without any problem.

I've always wanted them to be committed as opt-in knobs, but I can't
remember why they hadn't at the time.

Jeremie Le Hen

Men are born free and equal.  Later on, they're on their own.
				Jean Yanne

More information about the freebsd-current mailing list