News for hackers. Stuff that matters.
Re:Never run ldd on unknown executables by pjmlp on Monday July 24, 2023 @03:28AM (#36844184)
Translation, worse is better philosophy.
Re:Never run ldd on unknown executables by anthk on Monday July 24, 2023 @08:19AM (#36846739)
9front does it better. No dynamic linking. At all.
Re:Never run ldd on unknown executables by cryptonector on Monday July 24, 2023 @01:09PM (#36851164)
User-land code can always add dynamic linking.
Re:Never run ldd on unknown executables by cryptonector on Monday July 24, 2023 @01:10PM (#36851174)
Not really. Would you rather that the dynamic linker-loader be part of the kernel? Do you think that the kernel can somehow prohibit user-land dynamic linking?
Re:Never run ldd on unknown executables by pjmlp on Tuesday July 25, 2023 @02:09AM (#36858563)
I would rather have it as Windows and AIX do, or even mainframes, or by gone systems of similar age like Xerox PARC or ETHZ ones, yes they are in the kernel.

In any case, modern security considerations have already shown that dynamic loading of foreign code into process memory isn't that much of a good idea after all, unless there are hardware restrictions regarding performace and memory use.

Re:Never run ldd on unknown executables by cryptonector on Tuesday July 25, 2023 @04:14PM (#36868680)
Well, I don't want dynamic linking and loading of user code to be done in the kernel -- that only increases the attack surface on the kernel.

> In any case, modern security considerations have already shown that dynamic loading of foreign code into process memory isn't that much of a good idea after all, [...]

As with many things it all depends on best practices and how you use the technology. Dynamic linking can be a big performance win. It can also be a performance loss. Dynamic linking can also be a big win in terms of code size, which even today is a good thing to have because container images can get bloated and you can need to have lots and lots of them, and it all adds up. None of that means you should be willing to dlopen() untrusted code, say.

And again, you can always implement your own dynamic linking and loading regardless of what such facilities (if any) the host OS provides.