ASLR/PIE status in FreeBSD HEAD

2020-04-17 Thread Marcin Wojtas
Hi, Together with our customers, Semihalf is interested in improving the status of security mitigations enablement in FreeBSD. To start with, based on our initial research it seems that after 2019 enhancements the ASLR/PIE features are in pretty much ready state. Building the world using the 'WIT

Re: ASLR/PIE status in FreeBSD HEAD

2020-04-17 Thread Shawn Webb
On Fri, Apr 17, 2020 at 02:58:06PM +0200, Marcin Wojtas wrote: > Hi, > > Together with our customers, Semihalf is interested in improving the status > of security mitigations enablement in FreeBSD. To start with, based on our > initial research it seems that after 2019 enhancements the ASLR/PIE >

Re: ASLR/PIE status in FreeBSD HEAD

2020-04-17 Thread Ed Maste
On Fri, 17 Apr 2020 at 08:58, Marcin Wojtas wrote: > > Hi, > > Together with our customers, Semihalf is interested in improving the status > of security mitigations enablement in FreeBSD. Happy to hear that there's interest in this work! > 1. Are there any hard blockers, like missing features or

Re: ASLR/PIE status in FreeBSD HEAD

2020-04-17 Thread Ed Maste
On Fri, 17 Apr 2020 at 09:13, Shawn Webb wrote: > > Quick note: paxtest's algorithms for measuring ASLR was meant to test > ASLR, not FreeBSD's ASR implementation. Thus, paxtest results for > FreeBSD's ASR are moot. paxtest's entropy estimate is superficial, and indeed can produce a more or less