PIE/PIC support on base

[Jeremie Le Hen]

On Fri, Oct 17, 2014 at 12:15 AM, Shawn Webb <lattera at gmail.com> wrote:
>
>
> On Thu, Oct 16, 2014 at 5:59 PM, Jeremie Le Hen <jlh at freebsd.org> wrote:
>>
>> On Thu, Oct 16, 2014 at 8:21 PM, David Carlier
>> <david.carlier at hardenedbsd.org> wrote:
>> >
>> > I chose the "atomic" approach, at the moment very few binaries are
>> > concerned at the moment. So I applied INCLUDE_PIC_ARCHIVE in the needed
>> > libraries plus created WITH_PIE which add fPIE/fpie -pie flags only if
>> > you
>> > include <bsd.prog.pie.mk> (which include <bsd.prog.mk>...) otherwise
>> > other
>> > binaries include <bsd.prog.mk> as usual hence does not apply. Look
>> > reasonable approach ?
>>
>> I think I understand what you mean.  But I think PIE is commonplace
>> nowadays and I don't understand what you win by not enabling it for
>> the whole system.  Is it a performance concern?  Is it to preserve
>> conservative minds from to much change? :)
>
>
> Looping in Kostik, Bryan Drewery, the PaX team, Hunger, and Sean Bruno.
>
> On i386, there is a performance cost due to not having an extra register
> available for the relocation work that has to happen. PIE doesn't carry much
> of a performance penalty on amd64, though it still does carry some on first
> resolution of functions (due to the extra relocation step the RTLD has to
> worry about). On amd64, after symbol resolution has taken place, there is no
> further performance penalty due to amd64 having an extra register to use for
> PIE/PIC. I'm unsure what, if any, performance penalty PIE carries on ARM,
> AArch64, and sparc64.
>
> Certain folk would prefer to see PIE enabled only in certain applications.
> /bin/ls can't really make much use of PIE. But sshd can. I personally would
> like to see all of base's applications compiled as PIEs, but that's a long
> ways off. It took OpenBSD several years to accomplish that. Having certain
> high-visibility applications (like sshd, inetd, etc) is a great start.
> Providing a framework for application developers to opt their application
> into PIE is another great start.
>
> Those are my two cents.

OK.  As long as i386 is still an important architecture, it can make
sense to enable this on a per-binary basis if we don't want to have a
discrepancy between archs. Also I buy your argument on /bin/ls but I
was challenging to enable for the whole system because I wonder if
there aren't some unexpected attack surfaces, besides the obvious ones
(servers).

Do you know what took so much time to OpenBSD?

-- 
Jeremie Le Hen
jlh at FreeBSD.org