OpenBSD system-call-origin verification

Re:OpenBSD system-call-origin verification by jacquesm on Sunday December 22, 2019 @06:21PM (#21860331)

Does that mean that linking against libc is mandatory and that applications are not allowed to bring their own version of libc along for instance when linked statically?

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by saagarjha on Sunday December 22, 2019 @06:23PM (#21860340)

Statically linked programs automatically lose this protection, apparently.

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by ori_b on Sunday December 22, 2019 @09:16PM (#21861040)

Partly. If they jit, or have shellcode injected, that code is not mappable with syscall privilege.

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by throwaway2048 on Sunday December 22, 2019 @07:10PM (#21860572)

This is a flag in the ELF binary section headers, if you don't want it, flag your entire binary as "syscalls allowed".

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by tedunangst on Sunday December 22, 2019 @06:50PM (#21860480)

No. There's nothing special about libc.

(Oh, double checked, and uh, maybe. ld.so does treat libc specially if it finds it in the library list, but at that point, you are linking with libc. But afaik there's no requirement you use the system ld.so either.)

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by jacquesm on Sunday December 22, 2019 @06:54PM (#21860495)

Then isn't Animats' point valid?

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by tedunangst on Sunday December 22, 2019 @07:15PM (#21860606)

The point of doing this is not to protect against people bringing their own bad libc.

[ Parent | on HN ]