Recent OpenBSD/luna88k progress and brief explanation of OpenBSD's new feature KARL (Kernel Address Randomized Link).
This talk was held in Nagoya *BSD Users' Group session at Open Source Conference 2018 Nagoya.
10. 10
ちなみに…
• ANNOUNCEMENTファイルより
---- THANKSTHANKSTHANKSTHANKS ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Ports tree and package building by PierrePorts tree and package building by PierrePorts tree and package building by PierrePorts tree and package building by Pierre----Emmanuel Andre, LandryEmmanuel Andre, LandryEmmanuel Andre, LandryEmmanuel Andre, Landry BreuilBreuilBreuilBreuil,,,,
VisaVisaVisaVisa HankalaHankalaHankalaHankala, Stuart Henderson, Peter, Stuart Henderson, Peter, Stuart Henderson, Peter, Stuart Henderson, Peter HesslerHesslerHesslerHessler, Paul, Paul, Paul, Paul IroftiIroftiIroftiIrofti, and, and, and, and
ChristianChristianChristianChristian WeisgerberWeisgerberWeisgerberWeisgerber.... Base and X system builds by Kenji AoyamaBase and X system builds by Kenji AoyamaBase and X system builds by Kenji AoyamaBase and X system builds by Kenji Aoyama,,,,
Theo deTheo deTheo deTheo de RaadtRaadtRaadtRaadt, and Visa, and Visa, and Visa, and Visa HankalaHankalaHankalaHankala....
OpenBSDはリリースバイナリをクロスビルドしない主義なので、
世界中で他にリリースバイナリ作れる人がいない…
https://ftp.openbsd.org/pub/OpenBSD/6.3/ANNOUNCEMENT
11. 11
最近のOpenBSDの新機能:KARL
• KARL: Kernel Address Randomized Link
– a new “link-kit” allows the .o files of the kernel
to be relinked in a random order, creating a
unique kernel for each boot.
(OpenBSD 6.2から導⼊)
• カーネルのメモリ配置を毎回変えてセキュリ
ティを高める
• ちなみに 6.0 以降は、libc も起動時に毎回ラン
ダムにリンクし直すようになっています
(起動が遅くなるので自分のluna88kでは
/etc/rc.conf.local でlibrary_aslr=NO 設定:-)
Port maintainerから⾒た
13. 13
KARL:ざっくりと解説(2)
• 起動時、/etc/rc の最後で再度カーネルをリンク
• 次回起動時はこのカーネルが使われる
:
# Re-link the kernel, placing the objects in a random order.
# Replace current with relinked kernel and inform root about it.
/usr/libexec/reorder_kernel &
:
cd $KERNEL_DIR/$KERNEL
make newbsd
make newinstall
echo "¥nKernel has been relinked and is active on next reboot.¥n"
cat $SHA256
/usr/libexec/reorder_kernel の最後
/etc/rc の最後
カーネルの .o ファイルがあるディレクトリで
make && make install する
… もう⼀度リンクすると何が変わるのか?
