Philip Guenther <[email protected]> writes: > On Sun, Apr 14, 2013 at 2:02 PM, Jérémie Courrèges-Anglas > <[email protected]> wrote: >> Philip Guenther <[email protected]> writes: > ... >>> As for -z now: yeah, it works on OpenBSD; what problem are they trying >>> to solve by using it? >> >> -z now seems to be useful when used together with -z relro, IIUC, >> allowing the global offset table to be marked read-only. If there is >> anything like that on OpenBSD, I'd like to use it for this port, else >> I'll just disable upstream hardening flags. > > On OpenBSD, the GOT is marked read-only except when a lazy relocation > is actually being resolved and updated. -znow eliminates the > mprotect(RW)/relocate/mprotect(RO) dance by paying the cost of doing > all relocations at load-time. For a single-threaded program, it's hard > to argue that there's any security benefit to eliminating that as only > ld.so is running in that window.
Oh, nice... (now I understand better why the lots of mprotect calls in kdump output). I'll just disable upstream hardening flags, then. > Philip Guenther Thanks again! -- Jérémie Courrèges-Anglas PGP Key fingerprint: 61DB D9A0 00A4 67CF 2A90 8961 6191 8FBF 06A1 1494
