From: deraadt Date: Mon, 29 May 2017 09:44:01 +0000 (+0000) Subject: Randomize link-order of libcrypto as we do with libc. This library X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=b4134599494ff5cfd9dd39bb598235dba5f11c35;p=openbsd Randomize link-order of libcrypto as we do with libc. This library has many small functions without significant local storage, therefore less tail protection from -fstack-protector-strong to prevent their use as ROP gadgets. It is used in security contexts. Also many functions dribble pointers onto the stack, allowing discovery of gadgets via the fixed relative addresses, so let's randomly bias those. ok tedu jsing The rc script will soon need a strategy for skipping this step on machines with poor IO performance. Or maybe do it less often? However, I don't see many more libraries we'll do this with, these are the two most important ones. --- diff --git a/etc/rc b/etc/rc index b60da0f6117..ae73f2ff0e6 100644 --- a/etc/rc +++ b/etc/rc @@ -1,4 +1,4 @@ -# $OpenBSD: rc,v 1.495 2017/05/01 14:01:47 rpe Exp $ +# $OpenBSD: rc,v 1.496 2017/05/29 09:44:01 deraadt Exp $ # System startup script run by init on autoboot or after single-user. # Output and error are redirected to console by init, and the console is the @@ -168,7 +168,7 @@ reorder_libs() { echo -n 'reordering libraries:' # Only choose the latest version of the libraries. - for _liba in /usr/lib/libc.so.*.a; do + for _liba in /usr/lib/libc.so.*.a /usr/lib/libcrypto.so.*.a; do _liba=$(ls ${_liba%%.[0-9]*}*.a | sort -V | tail -1) for _l in $_libas; do [[ $_l == $_liba ]] && continue 2 diff --git a/lib/libcrypto/Makefile b/lib/libcrypto/Makefile index 6454d6b109e..4e9528a5d9e 100644 --- a/lib/libcrypto/Makefile +++ b/lib/libcrypto/Makefile @@ -1,6 +1,7 @@ -# $OpenBSD: Makefile,v 1.17 2017/05/06 20:42:57 beck Exp $ +# $OpenBSD: Makefile,v 1.18 2017/05/29 09:44:01 deraadt Exp $ LIB= crypto +LIBREBUILD=y .include .ifndef NOMAN