Messages in this thread | | | Date | Tue, 26 Jul 2016 20:59:44 +0000 | From | Jason Cooper <> | Subject | Re: [PATCH] [RFC] Introduce mmap randomization |
| |
Hi William,
On Tue, Jul 26, 2016 at 08:13:23PM +0000, Roberts, William C wrote: > > > From: Jason Cooper [mailto:jason@lakedaemon.net] > > > On Tue, Jul 26, 2016 at 11:22:26AM -0700, william.c.roberts@intel.com wrote: > > > > Performance Measurements: > > > > Using strace with -T option and filtering for mmap on the program ls > > > > shows a slowdown of approximate 3.7% > > > > > > I think it would be helpful to show the effect on the resulting object code. > > > > Do you mean the maps of the process? I have some captures for whoopsie on my > > Ubuntu system I can share.
No, I mean changes to mm/mmap.o.
> > One thing I didn't make clear in my commit message is why this is good. Right > > now, if you know An address within in a process, you know all offsets done with > > mmap(). For instance, an offset To libX can yield libY by adding/subtracting an > > offset. This is meant to make rops a bit harder, or In general any mapping offset > > mmore difficult to find/guess.
Are you able to quantify how many bits of entropy you're imposing on the attacker? Is this a chair in the hallway or a significant increase in the chances of crashing the program before finding the desired address?
thx,
Jason.
| |