[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54826CAA.6040509@gmail.com>
Date: Fri, 05 Dec 2014 21:40:42 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Offset2lib: bypassing full ASLR on 64bit Linux
On 05/12/14 09:23 PM, Reed Loden wrote:
> On Fri, Dec 5, 2014 at 4:59 PM, Daniel Micay <danielmicay@...il.com> wrote:
>
>>
>> I don't really see how this would prevent Mozilla from shipping a
>> browser with ASLR. The Tor browser has been shipping a fork of Firefox
>> built as a position independent executable for ages. It doesn't impact
>> users because they're either starting it via a .desktop file or the
>> command-line.
>>
>> The support for desktop icons in Nautilus is deprecated / disabled by
>> default with only a hidden dconf preference to enable it. If you really
>> want to support the workflow of opening up the file manager, navigating
>> to the binary and double-clicking it then using a wrapper script is a
>> quite obvious solution.
>>
>
> Obviously, some users are running into it (
> https://bugzilla.mozilla.org/show_bug.cgi?id=1076892), or it wouldn't have
> had to be backed out.
>
> ~reed
So why can't you hide away the binary and drop a script or desktop file
in that directory instead? A desktop file would also provide a better
user experience if unpacking it and using it directly from that
directory via a file manager is something you want to support.
You would be even better off making it a self-extracting archive,
dropping itself into $XDG_DATA_HOME / ~/.local/share like Steam (which
uses PIE...), and generating a desktop file to run it. There's no icon
or any other GUI niceties for the raw executable.
It's not the usual / supported way of doing things, so it's really not
surprising that it depends on a libmagic/file hack that doesn't work on
any security aware native executables. There is no shortage of projects
that have been enabling full ASLR for nearly a decade. The reason that
this is an issue for you isn't because PIE isn't well supported.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
