Slashdot Mirror
OpenBSD's Kernel Gets W^X Treatment On Amd64
New submitter brynet tips this news from Theo de Raadt:
Over the last two months Mike Larkin (mlarkin@) modified the amd64 kernel to follow the W^X principles. It started as a humble exercise to fix the .rodata segment, and kind of went crazy. As a result, no part of the kernel address space is writeable and executable simultaneously. At least that is the idea, modulo mistakes. Final attention to detail (which some of you experienced in buggy drafts in snapshots) was to make the MP and ACPI trampolines follow W^X, furthermore they are unmapped when not required. Final picture is many architectures were improved, but amd64 and sparc64 look the best due to MMU features available to service the W^X model. The entire safety model is also improved by a limited form of kernel ASLR (the code segment does not move around yet, but data and page table ASLR is fairly good."
Actually, I was just thinking that this was a relatively penetrable summary. It tells me so much, I don't even need to R TFA.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The summary could use a bit of translation, instead of merely copying content off a maillist post intended for a very specific group of kernel specialists using slang terminology.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Once you grok that W^X means Write XOR Execute (which you can gather from the rest of the summary), it gets easier.
Once you grok that W^X means Write XOR Execute (which you can gather from the rest of the summary), it gets easier.
I thought that meant they added all wheel drive and turbos.
According to Wikipedia, which is always right:
Similar features are available for other operating systems, including the PaX and Exec Shield patches for Linux, and NetBSD 4+'s implementation of PaX.
W^X
I expected a long rant from TdR. I was disappointed.
If you have a need to get something translated maybe it's worth to look it up.
Everyone is so used to get everything served on a plate these days that when the need arises they are completely lost in how to dig for information.
I see this as a nice teaser that isn't dumbed-down.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
My guess is 80% of you will get about 20% of what this email is saying, but you'll post on here like you know it all. /reflections of myself about 15 years ago. //Modulo mistakes... cute
Search your feelings, you know it to be true.
20% is still more than Theo De Raadt wanted anyone else to understand. So, I call it a win.
Except that only userland benefitted from that till now.
Now it's even for the kernel, that's the news here.
I gave up with the idea of an useful sig...
Yes, there is some cross-pollination. In general, while BSDs share a common background, they are different operating systems, not "distros".
C'mon, people, it's writexorexecute, as in "xor" as in "exclusive or". Write or execute is exactly what they're trying to avoid.
Never bothered learning how to tag stuff or contribute to tags on Slashdot, so just ranting here. Thank you, that is all.
I don't know, it's not like there is some sort of free services out there that could help you find the explanation without parsing the whole list.
https://en.wikipedia.org/wiki/Trampoline_%28computing%29
I doubt that the mailing list will show any definition of "trampoline". That word has a specific meaning in kernel programming, such that one would already have a good understanding of the subject before poking around in kernel code.
FWIW, "trampoline" refers to generated bits of code containing jumps to arbitrarily different pieces of code, something that ESR called "an incredibly hairy technique" in the Jargon File.
In Soviet Russia, Jesus asks: "What Would You Do?"
Sure, if someone ports it over. They do share features but not all BSD kernels have all the same features.
In the english language itself, "or" doesn't necessarily imply "xor". Usually some other mechanism is used to imply exclusivity, either from situational awareness or from context in the surrounding text.
Next, some noob is going to ask what "ESR," "hairy" and "jargon file" are. And then somebody else won't know what "noob" means. It's the Eternal September all over again (said the guy with the six-digit ID to the guy with the four-digit one)...
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Still of limited value. ROP already bypasses DEP/NX protections, which are required for W^X to be effective. ROP techniques are used to great effect in iPhone jailbreaks.
These protections may guard against a (very small subset of) casual attackers, but they're just another minor hurdle for determined attackers.
For a primer, see also: https://en.wikipedia.org/wiki/... (And the rest of the article.)
The biggest security advantage that BSD has is being such a small target.
https://www.eff.org/https-everywhere
with BSD being in everything from printers to elevator controllers (and Apple products), it's not a small target but more of a less visible one to date
Mmm, it made sense to me, but then I work at low levels of code. I do find it somewhat strange though that the criticism is basically that it's too nerdy. I'm quite happy to see more nerd postings and fewer Dice fluff. Stories that go over the heads of the masses is what Slashdot should be about.
This is nothing new, there have been articles with absolutely impenetrable jargon and ideas before when discussing high level web oriented stuff or scripting, but since so many readers these days work in such areas that they don't complain. So I have to look up what jquery is, it's not a problem, so others who call themselves nerds should be content to look up with W^X means.