Is pre-linking worth it? [LWN.net]

Is pre-linking worth it?

Posted Jul 15, 2009 23:12 UTC (Wed) by nix (subscriber, #2304)
In reply to: Is pre-linking worth it? by jake
Parent article: Is pre-linking worth it?

A *local* attacker? If a hostile attacker has got onto your system and can
observe /proc/self/maps for security-critical programs (say, those running
as root) you have already lost, ASLR or no ASLR. If you are concerned
about hostile users, chmod such programs so that only root can execute
them, or explicitly 'prelink --undo' them to re-enable ASLR for those
programs.

I was talking about ASLR's role in stopping them from getting on in the
first place, when they have to use 'did {this part of} the exploit work?'
as an oracle.

to post comments

Is pre-linking worth it?

Posted Jul 15, 2009 23:25 UTC (Wed) by jake (editor, #205) [Link] (1 responses)

> A *local* attacker? If a hostile attacker has got onto your system and can
> observe /proc/self/maps for security-critical programs

I think we are talking across each other. If an attacker can do 'cat /proc/self/maps', and thus see the memory map of 'cat', they will see where libc is mapped. On a pre-linked system, that is the likely place it is mapped for *other* interesting programs. So, a local attacker, or one who can get map information for simple, non-security-critical programs, can then use that information in a buffer overflow or other exploit of the security-critical program of interest (assuming it links to libc).

*that* is a security hole for pre-linking ...

(btw, your email notifications are bouncing :)

jake

Is pre-linking worth it?

Posted Jul 16, 2009 0:36 UTC (Thu) by nix (subscriber, #2304) [Link]

Agreed: prelink is problematic iff you have hostile local users, but if
you avoid prelinking privileged programs, libc will be mapped elsewhere
for those programs.

(Sorry about the bounces: my ISP, Zetnet, has gone insane, changing my
static IP but failing to tell me the new IP address ahead of time, failing
to update my DNS zone even when specifically requested, so all its RRs
still point to the old address, messing up the MX relay so that all
incoming email, even to their own DNS administrator, gets bounced rather
than queued, and failing to give me a MAC code (horrid UK-specific
broadband techspeak) as they are legally obliged to, so I can't even
switch to a new ISP. It's absolutely crazy, and I can do nothing
whatsoever about it. God knows what email I've lost.

To make this Linux-relevant, let this be a lesson to everyone in the
dangers of making Debian developers redundant, especially when they know
the network from top to bottom and you're just about to carry out major
changes to that network. In fact it's better never to make Debian
developers redundant at all. Actually it's best if you just give them lots
of money without their even needing to ask. Really.)