SSHD: Random boot time relinking, OpenBSD
undeadly.org
SSHD: Random boot time relinking, OpenBSD
1–10 of 55 posts
Re: SSHD: Random boot time relinking, OpenBSD
#2Finally!
At least, someone finally understands that static, fully predictable, reproduce-able-builds are only an convenience feature for the attacker side.
Re: SSHD: Random boot time relinking, OpenBSD
#3Finally! At least, someone finally understands that static, fully predictable, reproduce-able-builds are only an convenience feature for the attacker side.
It’s not that finally. OpenBSD got kernel boot time relinking in 2017 (https://marc.info/?l=openbsd-tech&m=149887978201230&w=2). This extends it to an outward-facing executable.
I guess the holy grail would be to combine this with hot patching (https://en.wikipedia.org/wiki/Patch_(computing)#HOT-PATCHING), and relink the kernel every now and then while it is running (currently, a system under attack would have to be rebooted every now and then, and that’s undesirable). That would face ‘a few’ technical hurdles, though.
Re: SSHD: Random boot time relinking, OpenBSD
#4It's there a good link for the details? I'm guessing this does more than ASLR?
Re: SSHD: Random boot time relinking, OpenBSD
#5Finally! At least, someone finally understands that static, fully predictable, reproduce-able-builds are only an convenience feature for the attacker side.
It’s not that finally. OpenBSD got kernel boot time relinking in 2017 ( https://marc.info/?l=openbsd-tech&m=149887978201230&w=2 ). This extends it to an outward-facing executable. I guess the holy grail would be to combine this with hot patching ( https://en.wikipedia.org/wiki/Patch_(computing)#HOT-PATCHING ), and relink the kernel every now and then while it is running (currently, a system under attack would have to…
Yeah I was just thinking this; I've got like years of uptime on my OpenBSD server--don't know how much boot time relinking is helping me. But for like, desktops and laptops, it's fine and a great feature IMO (you probably wade through a lot more muck on a personal machine)
Re: SSHD: Random boot time relinking, OpenBSD
#6It's there a good link for the details? I'm guessing this does more than ASLR?
Plain, simple and effective as always!
The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :)
Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd
https://github.com/openbsd/src/commit/898412097f87ba70d4012f...
Re: SSHD: Random boot time relinking, OpenBSD
#7Earlier quoted context omitted.
It’s not that finally. OpenBSD got kernel boot time relinking in 2017 ( https://marc.info/?l=openbsd-tech&m=149887978201230&w=2 ). This extends it to an outward-facing executable. I guess the holy grail would be to combine this with hot patching ( https://en.wikipedia.org/wiki/Patch_(computing)#HOT-PATCHING ), and relink the kernel every now and then while it is running (currently, a system under attack would have to…
Yeah I was just thinking this; I've got like years of uptime on my OpenBSD server--don't know how much boot time relinking is helping me. But for like, desktops and laptops, it's fine and a great feature IMO (you probably wade through a lot more muck on a personal machine)
If you have years of uptime on an openbsd machine you are not keeping it up to date.
I have to admit I am guilty of this as well, but any mantained openbsd setup should have an uptime of no more than 6 months and a well maintained openbsd setup will be shorter than that as security patches are applied.
Having said that one of the things I like about openbsd is that if you want to go dark and have an ultra stable system(no updates ever) all the pieces are there for you, (you will want to have the source, I would also make sure I have the ports tree for that release and a copy of the ports dist files.)
Re: SSHD: Random boot time relinking, OpenBSD
#8It's there a good link for the details? I'm guessing this does more than ASLR?
Plain, simple and effective as always! The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :) Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd https://github.com/openbsd/src/commit/898412097f87ba70d4012f...
Ah, so that will have some features of ASLR missing. Specifically, you can't do this on a read only root and it didn't randomise the stack location as far as I can tell?
Re: SSHD: Random boot time relinking, OpenBSD
#9Earlier quoted context omitted.
Plain, simple and effective as always! The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :) Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd https://github.com/openbsd/src/commit/898412097f87ba70d4012f...
Ah, so that will have some features of ASLR missing. Specifically, you can't do this on a read only root and it didn't randomise the stack location as far as I can tell?
Wouldn't the stack location be set at runtime and given by the stack register at the entry point?
Re: SSHD: Random boot time relinking, OpenBSD
#10Earlier quoted context omitted.
Plain, simple and effective as always! The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :) Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd https://github.com/openbsd/src/commit/898412097f87ba70d4012f...
Ah, so that will have some features of ASLR missing. Specifically, you can't do this on a read only root and it didn't randomise the stack location as far as I can tell?
For this new feature you pay indeed with the need for r/w and executable tmpfs/overlay somewhere.
This does not replace classic ASLR: OpenBSD 5.7 activated position-independent static binaries (Static-PIE) by default.
https://en.wikipedia.org/wiki/Address_space_layout_randomiza...