Subject: Re: Importing PaX features to NetBSD
To: None <pageexec@freemail.hu>
From: Matt Thomas <matt@3am-software.com>
List: tech-security
Date: 12/18/2005 16:50:44
pageexec@freemail.hu wrote:
> On 18 Dec 2005 at 16:12, Matt Thomas wrote:
> 
>>PIE also forces a portion of .text to be nonshared (any relative relocations
>>that could be fixed in a based image will no longer be shared among multiple
>>processes).  It will increase the complexity of program loading which is
>>already very complex.
> 
> 
> uhm, not sure what you're talking about. PIEs have as many textrels as
> shared libs, up to you compile all .o files with -fpie (vs. -fpic). in
> practice, we have Hardened Gentoo fully PIE compiled and the usual textrels
> only (that is, mostly in multimedia related shared libs that use lots
> of non-PIC asm, we've also fixed a bunch of them already).

Normal executable don't need REL relocation since they are linked at a
fixed address.  Since PIE executables are closer to PIC (shared) libraries,
they will have to have relocations done at load time, not link time.

Things like 'const char * const foo[] = { "a", "b" };' will be placed
entirely in .rodata since of the text PT_LOAD for a normal executable
which means that it can be shared.  In a PIE executable, foo will need
to relocated and so can not be shared.  So PIE not only have a CPU cost
for the relocations, but also a memory cost since fewer pages can be shared.

-- 
Matt Thomas                     email: matt@3am-software.com
3am Software Foundry              www: http://3am-software.com/bio/matt/
Cupertino, CA              disclaimer: I avow all knowledge of this message.