On 26 August 2016 at 10:18, Warner Losh <i...@bsdimp.com> wrote: > > So what's the summary of why we'd want to do that? What benefit does it bring? > Sure, other folks do it, but why?
It's a relatively low cost technique to mitigate certain vulnerabilities. rtld needs to write to some sections during load but they don't need to be writeable after starting the program. relro reorders the output sections so that they are grouped together, and rtld remaps them read-only on start. This is often called "partial relro." I don't know of any real downside to enabling it, other than it could possibly break some strangely built third party software. It's been enabled on other platforms for quite some time though and I doubt we'd run into new issues. It doesn't bring a huge benefit by itself though; the PLT is still writeable. Adding "-z now" to the linker invocation produces "full relro" which makes the PLT read-only too. It has a negative impact on process start-up time though. _______________________________________________ freebsd-toolchain@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-toolchain To unsubscribe, send any mail to "freebsd-toolchain-unsubscr...@freebsd.org"
