Include SelfRando patches into our hardened builds
The folks behind the Readactor and Readactor++ paper have developed patches for better resistance against code reuse attacks. This ticket tracks their inclusion both into tor-browser and tor-browser-bundle.
Activity
Trac:
Description: The folks behind the Readactor and Readactor++ paper have developed patches for better resistance against code reuse attacks. This tickets tracks their inclusion bot into tor-browser and tor-browser-bundle.to
The folks behind the Readactor and Readactor++ paper have developed patches for better resistance against code reuse attacks. This ticket tracks their inclusion both into tor-browser and tor-browser-bundle.
-
bug_17406_v2 (https://gitweb.torproject.org/user/gk/tor-browser-bundle.git/commit/?h=bug_17406_v2) in my public tor-browser-bundle repo has a patch for testing SelfRando in our hardened nightly builds. This is nothing for the hardened alpha series yet. Please review.
Trac:
Keywords: GeorgKoppen201511, TorBrowserTeam201512 deleted, TorBrowserTeam201605R, GeorgKoppen201605 added
Status: new to needs_review
Reviewer: N/A to N/A
Cc: mcs to mcs, boklm 
I didn't try to build it yet (I started one but it's not finished yet), but it looks good.
One small thing, in
RelativeLink/start-tor-browser, with this line:LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/:${LD_LIBRARY_PATH}"I think that when
$LD_LIBRARY_PATHis undefined, it is similar to adding.to the library path, which might cause some problems.Trac:
Status: needs_review to needs_revision-
My build failed with a
Cannot allocate memoryerror:+ /home/debian/install/binutils/bin/ld.gold --section-start .dynsym=0x800 -dn /home/debian/install/self-rando/randoentry.o /home/debian/install/self-rando/sr_begin.o /home/debian/install/self-rando/libselfrando.a /home/debian/install/self-rando/sr_end.o -dy -plugin /home/debian/install/gcc/libexec/gcc/x86_64-unknown-linux-gnu/5.2.0/liblto_plugin.so -plugin-opt=/home/debian/install/gcc/libexec/gcc/x86_64-unknown-linux-gnu/5.2.0/lto-wrapper -plugin-opt=-fresolution=/tmp/ccpIArYG.res -plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lc -plugin-opt=-pass-through=-lgcc_s --eh-frame-hdr -m elf_x86_64 -shared -o libxul.so /usr/lib/x86_64-linux-gnu/crti.o /home/debian/install/gcc/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/crtbeginS.o -L/home/debian/build/selfrando/Tools/TorBrowser/tc-wrapper -L/home/debian/install/gcc/lib/gcc/x86_64-unknown-linux-gnu/5.2.0 -L/home/debian/install/gcc/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../../../lib64 -L/lib/x86_64-linux-gnu -L/lib/../lib64 -L/usr/lib/x86_64-linux-gnu -L/home/debian/install/gcc/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../.. -lasan -h libxul.so /home/debian/build/tor-browser/obj-x86_64-unknown-linux-gnu/toolkit/library/tmpDCjBHo.list -lpthread -ldl -z noexecstack -z text --build-id -Bsymbolic -version-script symverscript -rpath-link /home/debian/build/tor-browser/obj-x86_64-unknown-linux-gnu/dist/bin -rpath-link NONE/lib ../../intl/icu/target/lib/libicui18n.a ../../intl/icu/target/lib/libicuuc.a ../../intl/icu/target/lib/libicudata.a ../../security/nss/lib/crmf/libcrmf.a ../../js/src/libjs_static.a ../../security/nss/lib/nss/libnss3.so ../../security/nss/lib/smime/libsmime3.so ../../security/nss/lib/ssl/libssl3.so ../../security/nss/lib/util/libnssutil3.so ../../config/external/sqlite/libmozsqlite3.so ../../nsprpub/lib/ds/libplds4.so ../../nsprpub/lib/libc/src/libplc4.so ../../nsprpub/pr/src/libnspr4.so ../../config/external/lgpllibs/liblgpllibs.so -ldl -lfreetype -lfontconfig -lrt -lXrender -lasound -ldbus-glib-1 -ldbus-1 -lgobject-2.0 -lglib-2.0 -lgtk-x11-2.0 -latk-1.0 -lgio-2.0 -lpangoft2-1.0 -lgdk-x11-2.0 -lpangocairo-1.0 -lgdk_pixbuf-2.0 -lpango-1.0 -lcairo -lX11 -lXext -lXt -lgthread-2.0 -lstdc++ -lm -lgcc_s -lc -lgcc_s /home/debian/install/gcc/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/crtendS.o /usr/lib/x86_64-linux-gnu/crtn.o --build-id=none -Map libxul.so.map ./padding.AF50QyuurRhLB4T.o + /home/debian/install/self-rando/SymProc libxul.so libxul.so.map -ffunction-sections Can't start ar: Cannot allocate memory Can't extract file /usr/lib/x86_64-linux-gnu/libpthread_nonshared.a(pthread_atfork.oS) tmpfile: /tmp/archived_file_Bm5hxW.o collect2: error: ld returned 15 exit status make[5]: *** [libxul.so] Error 1 -
Replying to boklm:
I didn't try to build it yet (I started one but it's not finished yet), but it looks good.
One small thing, in
RelativeLink/start-tor-browser, with this line: {{{ LD_LIBRARY_PATH="{LD_LIBRARY_PATH}" }}}I think that when
$LD_LIBRARY_PATHis undefined, it is similar to adding.to the library path, which might cause some problems.Yes, and I think we want to make sure that Tor Browser is only starting with the
LD_LIBRARY_PATHwe intended. Thus, I removed:${LD_LIBRARY_PATH}. bug_17406_v3 (https://gitweb.torproject.org/user/gk/tor-browser-bundle.git/commit/?h=bug_17406_v3) contains this and a small comment fixup.Trac:
Status: needs_revision to needs_review
