Re: paxctl(8) and ASLR - bug?

[Thor Lancelot Simon <tls%panix.com@localhost>]

On Sun, Jun 05, 2011 at 03:21:41PM +0200, Jean-Yves Migeon wrote:
> 
> Here, ASLR is a flag associated to an executable. IIRC, NetBSD's ldd
> does not execute the binary directly to resolve symbols (by setting
> LD_TRACE_LOADED_OBJECTS env variable and let the dynamic linker print
> the information, like ld-linux.so), it performs the lookup itself.
> 
> In fact, you get the PaX flag from ldd (which is off there), rather than
> the one from ./main.
> 
> Try with paxctl +A $(which ldd).

Oof!  This isn't safe to do, because it will apply ASLR in cases where it
is known to be unsafe -- just like enabling it globally would.

It seems to me ldd *must* look at the executable and use the ASLR
flag value from there, or the enabling of ASLR on a per executable
basis cannot really work.

Thor