Is pre-linking worth it? [LWN.net]

Is pre-linking worth it?

Posted Jul 15, 2009 17:06 UTC (Wed) by fuhchee (guest, #40059)
Parent article: Is pre-linking worth it?

Looking at your last paragraph, I can't match up these two claims: ... it may well be that for the majority of users, the annoyance and dangers are just not worth it ... and ... a problem like Rawhide suffered seems unlikely to occur in more polished, non-development releases ...

What "annoyance and dangers" does "that majority" experience, other than that single rawhide bug (which by nature is not used by many people)?

to post comments

Is pre-linking worth it?

Posted Jul 15, 2009 17:20 UTC (Wed) by jake (editor, #205) [Link] (6 responses)

hmm, "unlikely" does not mean impossible. there are potential dangers associated with pre-linking, from possible bugs to security implications, as i thought i described in the article; perhaps i didn't communicate them well, though. the annoyances are things like prelink needing to run regularly, changing binary files which makes binary integrity harder to check, etc.

and, if i am not mistaken, Fedora would like to see *more* people use rawhide.

jake

Is pre-linking worth it?

Posted Jul 15, 2009 21:11 UTC (Wed) by nix (subscriber, #2304) [Link] (5 responses)

On 64-bit boxes, of course, there are pretty much no security implications
of prelinking: even if ASLR *is* statically determined when prelink is
active, the address space is large enough that an attacker has little
chance of success anyway. And the address space on 32-bit is small enough
that ASLR is at best a band-aid.

The danger with prelink isn't that it lets attackers bruteforce their way
past ASLR (they can do that anyway). It's that *if* they have a multistage
attack to carry out (guess ASLRed addresses then guess something else,
say) and *if* they can tell that ASLR has been defeated and *if* each
attack round involves exec()ing a new program (rather than fork()ing an
old one or using a thread pool), then they can eliminate the effects of
ASLR more rapidly and concentrate on the second part of the attack, if
prelink is in use.

I'm not sure this actually affects many programs. openssh is the only one
I can think of that actually exec()s a new copy of itself when a request
comes in (specifically to allow ASLR to rerandomize things). Apache
doesn't do this and neither does anything else I can think of except for
services run from inetd.

Can anyone think of any other network-facing programs this might affect?

(I don't prelink my 32-bit firewalls for exactly this reason. Boxes behind
the firewall get prelinked.)

Is pre-linking worth it?

Posted Jul 15, 2009 21:53 UTC (Wed) by jake (editor, #205) [Link] (4 responses)

> On 64-bit boxes, of course, there are pretty much no security implications
> of prelinking: even if ASLR *is* statically determined when prelink is
> active, the address space is large enough that an attacker has little
> chance of success anyway.

Hmm, the security problems with pre-linking don't center around brute-forcing library addresses, I don't think. Instead, if an attacker can run a program and see where libc (for example) ends up in their memory map, they can be pretty sure it will be in the same place for other targets of interest. For up to two weeks.

jake

Is pre-linking worth it?

Posted Jul 15, 2009 23:12 UTC (Wed) by nix (subscriber, #2304) [Link] (2 responses)

A *local* attacker? If a hostile attacker has got onto your system and can
observe /proc/self/maps for security-critical programs (say, those running
as root) you have already lost, ASLR or no ASLR. If you are concerned
about hostile users, chmod such programs so that only root can execute
them, or explicitly 'prelink --undo' them to re-enable ASLR for those
programs.

I was talking about ASLR's role in stopping them from getting on in the
first place, when they have to use 'did {this part of} the exploit work?'
as an oracle.

Is pre-linking worth it?

Posted Jul 15, 2009 23:25 UTC (Wed) by jake (editor, #205) [Link] (1 responses)

> A *local* attacker? If a hostile attacker has got onto your system and can
> observe /proc/self/maps for security-critical programs

I think we are talking across each other. If an attacker can do 'cat /proc/self/maps', and thus see the memory map of 'cat', they will see where libc is mapped. On a pre-linked system, that is the likely place it is mapped for *other* interesting programs. So, a local attacker, or one who can get map information for simple, non-security-critical programs, can then use that information in a buffer overflow or other exploit of the security-critical program of interest (assuming it links to libc).

*that* is a security hole for pre-linking ...

(btw, your email notifications are bouncing :)

jake

Is pre-linking worth it?

Posted Jul 16, 2009 0:36 UTC (Thu) by nix (subscriber, #2304) [Link]

Agreed: prelink is problematic iff you have hostile local users, but if
you avoid prelinking privileged programs, libc will be mapped elsewhere
for those programs.

(Sorry about the bounces: my ISP, Zetnet, has gone insane, changing my
static IP but failing to tell me the new IP address ahead of time, failing
to update my DNS zone even when specifically requested, so all its RRs
still point to the old address, messing up the MX relay so that all
incoming email, even to their own DNS administrator, gets bounced rather
than queued, and failing to give me a MAC code (horrid UK-specific
broadband techspeak) as they are legally obliged to, so I can't even
switch to a new ISP. It's absolutely crazy, and I can do nothing
whatsoever about it. God knows what email I've lost.

To make this Linux-relevant, let this be a lesson to everyone in the
dangers of making Debian developers redundant, especially when they know
the network from top to bottom and you're just about to carry out major
changes to that network. In fact it's better never to make Debian
developers redundant at all. Actually it's best if you just give them lots
of money without their even needing to ask. Really.)

Is pre-linking worth it?

Posted Jul 16, 2009 6:05 UTC (Thu) by PaXTeam (guest, #24616) [Link]

ASLR was never meant to protect against local attacks, see http://lwn.net/Articles/334027/ for more explanation. the two week period is a vulnerability however for it's plenty of time to remotely brute force guess addresses (that is, when one cannot already leak addresses). that's why ASLR is really only meaningful when you can limit brute force search.