Show pageOld revisionsBacklinksBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== Mitigation Techniques ====== Reviewed mitigation technologies we should consider and attempted to decide if we should put effort into implementation. ===== W^X ===== * Basic implementation is perhaps 25 lines of unified diff * Deployment question; how do we accommodate applications * From CHERI, specify maximum permission * Further discussion in Friday session * Implementation strategy: add code to log W^X violations * ktrace / dtrace / audit / log entry * What static analysis could be done to identify W^X violations? * need ports infrastructure ===== noexec stack ===== * Get shared page support turned on everywhere to remove signal trampoline from stack. * Should audit libraries in ports. * libffi impacts many programs and requires executable stacks currently ===== CFI ===== * Clang - does not play well with shared libraries * Now "functions" but is not effective across library boundaries * Tiny bit of compiler-rt runtime * Requires LTO * PAX GPL+Patent Pending RAP ===== ASLR ===== * Two patches exist * %%HardenedBSD%% * vdso disabled after 3x * kib * also has disable-after-n-collisions * javascript, python, ... issues * Do we want it at all? * Yes, even if it can be bypassed it does increase work factor * Malloc may reduce available key space * Does jemalloc 5 layout change have any impact? * Next steps * Commit kib's patch (with or without process hierarchy control) * Extend control framework ===== KASLR ===== * Insufficient entropy * We likely leak through entirely too many interfaces * Apple has been eliminating kernel address exposure * Therefore KASLR is probably not worth implementing ===== SafeStack ===== * EPFL Has a fork of %%FreeBSD%%, patches to libc etc. to make this work * (David) not sure this buys you very much * HW vendors looking at implementing in HW what %%SafeStack%% does * It's a really interesting research project, but likely we should bypass * What is the implementation / maintenance cost? * setjmp, longjmp, ucontext * pthread interaction * applications that implement their own threading * Perhaps we could provide it only for statically linked things? * Would require patched crt*.o, libc, etc ===== SW PAN emulation (UDREF) ===== * Fine if it shows up, but do not expect to direct effort on it ===== PAN, SMAP ===== * PAN is committed * SMAP old GSOC to revive and do ===== PXN, SMEP ===== * PXN is committed * SMEP unstarted ===== Live patching ===== * Interesting, but each patch requires significant, one-off effort. * Project unlikely to have resources. ===== Refcount type / saturating or panic reference count ===== * Defend against refcount wrapping to 1 and then deleting on decrement. * Already here (gleb)? ===== Mitigation control, deployment ===== * force on / force off / unspecified * process, system, ELF object * sticky or not across exec * toolchain support - ld should be able to set these * Integrating support into ports build - would allow interesting tests to be performed across 27k ports * Report bad ports - pkg audit should report ports that don't specify nx stack or other mitigations ===== TODOs ===== * Add logging of W^X violations * Commit ASLR patch * Reconcile hardening list in installer with defaults * Have installer run %%FreeBSD%%-update devsummit/201708/security_mitigation.txt Last modified: 2018/04/01 00:59by MarkLinimon