Subject: Re: Importing PaX features to NetBSD
To: Tim Rightnour <root@garbled.net>
From: James Chacon <jmc@NetBSD.org>
List: tech-security
Date: 12/18/2005 11:58:47
On Sun, Dec 18, 2005 at 08:44:14AM -0700, Tim Rightnour wrote:
> 
> On 18-Dec-2005 matthew green wrote:
> > you fail to understand the performance issue here.  when, eg, libc is
> > not mapped at the same address as other processes, the performance hit
> > is in the range of 30-40% on some platforms.  it's not about start up
> > it is about the MMU being constantly trashed.
> 
> Whats the harm in providing the switch to turn it on though?  It sounds like a
> reasonable not-on-by-default kind of security thing.

If we have data which shows the impact to the end-user I think it's
probably reasonable as an option. Just slapping something in and saying
"well if they turn it on they made a choice" doesn't look good when people
enable the option and lose performance they didn't realize because nothing
quanitified it.

i.e. not only a switch, but clear documentation on the positives *and*
negatives to what it does.

James