News for hackers. Stuff that matters.
Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by dfox on Thursday January 26, 2023 @04:00PM (#34538752)
OpenBSD relinks sshd. Which is relatively small thing that is linked from relatively large objects (ie. it is the typical modern C code). Relinking thing like glibc on demand is going to be problematic, because it is structured as to allow small binary sizes for static linking and thus almost every function that is part of glibc API is a separate compilation unit and object file. Linking that into .so is slow, no mater what kind of optimalization tricks you implement in the linker.
Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by blibble on Thursday January 26, 2023 @06:54PM (#34540579)
doesn't matter how long it takes if you don't block the boot process doing it

you can link in the background at idle priority, and if you don't complete before reboot: no big deal

Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by saagarjha on Thursday January 26, 2023 @07:11PM (#34540717)
Relinking glibc would block the boot process.
Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by blibble on Thursday January 26, 2023 @07:30PM (#34540912)
how?

it's a dynamic library, and this isn't windoze with awful mandatory locking

as long as the underlying version is unchanged: there should be no problem whatsoever

Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by saagarjha on Friday January 27, 2023 @03:33AM (#34543934)
glibc is going to get used by everything in userspace, so you’ll need it when you boot.
Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by blibble on Friday January 27, 2023 @04:13AM (#34544146)
yes... it is there at boot

then after boot you relink for next boot

Re:Fun with Gentoo: Why don't we just shuffle those ROP gadg... by account42 on Friday January 27, 2023 @04:14AM (#34544150)
Yes, but this thread is about doing the linking after boot. It doesn't matter if you link synchronously before you start the program or link asynchronously after you start the program - you will still get a new unique binary for each boot.