OpenBSD system-call-origin verification

Re:OpenBSD system-call-origin verification by saagarjha on Monday December 23, 2019 @02:57AM (#21862143)

Are there any systems that implement widespread CFI for all binaries? The most I’ve seen is glibc’s endbr64 at the top of _start.

[ Parent | on HN ]

Re:OpenBSD system-call-origin verification by rwmj on Monday December 23, 2019 @03:24AM (#21862232)

Fedora 31 compiles everything with -fcf-protection. Of course it requires hardware support before it actually does anything, and there is a lot of missing support in the non-C toolchain and in certain packages. You can use "annocheck" to check if a particular binary is compiled with full control flow protection or not, eg:

    $ annocheck -v /usr/bin/ls
    [...]
    Hardened: /usr/bin/ls: PASS: Compiled with -fcf-protection.

[ Parent | on HN ]