>From the comment at https://reviews.freebsd.org/D5603
"The procctl(2) control for ASLR is implemented, [but] I have not provided a userspace wrapper around the syscall. In fact, the most reasonable control needed is per-image and not per-process, but we have no tradition to put the kernel-read attributes into the extattrs of binary, so I am still pondering that part and this also explains the non-written tool." I think its time to revisit the approach. Storing the attributes within the extattr is preferable to a central file - we're very fortunate to have the MAC framework, perhaps a MAC_ASLR is required (to identify those applications that can/can't use ASLR)? Other applications also make use of protection bits inside extattr, notably samba4. References: https://reviews.freebsd.org/D19281 mac_veriexec: Create kernel module to parse manifest based on envs. _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to "[email protected]"
