December 2014 - Arch-dev-public - lists.archlinux.org

[arch-dev-public] Proposal: enabling full ASLR on x86_64 via hardening-wrapper
by Daniel Micay 31 Dec '14

31 Dec '14

Arch's single biggest security weakness is that it's not benefiting from address space layout randomization (ASLR). Fixing this issue would be a major step towards being a leader in this area. Many distributions enable ASLR, stack protector, etc. for a chosen set of "security critical" stuff but very few enable them across the board. Executable permissions on memory (NX bit) prevent an attacker from directly injecting code via memory corruption vulnerabilities. It's only truly useful in combination with ASLR because if the existing code is in a known location it can be reused by the attacker.[1] [1] https://en.wikipedia.org/wiki/Return-oriented_programming The cost of ASLR is that it requires position independent (relocatable) code (PIC), as is already required for all code in dynamic libraries. On i686, PIC has a significant cost (up to 30% or more). The vanilla kernel also lacks emulation of the NX bit and has no brute force protection to make up for the smaller 32-bit address space. Only the subset of users using grsecurity / PaX would truly benefit. I don't care about i686 anyway. On x86_64, there's hardware support for position independent code so it's essentially free. It does currently cost ~1% due to linker and compiler limitations (indirection to access globals) but this has been fixed in the binutils/gcc master branches. It's much cheaper than the -fstack-protector-strong switch which we're already using, and the security value is higher. The only real barrier to enabling it is the lack of support in GCC for simply flipping it on by default. Library code is already built with -fPIC and is then linked with -shared. Full ASLR requires building the executable code with -fPIE (or -fPIC, which isn't as cheap) and then linking with -pie. There are two approaches to this: 1) Patching the toolchain's spec files (Hardened Gentoo) 2) Wrapper scripts for clang/gcc/ld.bfd/ld.gold (Debian, Fedora, Ubuntu) Upstream hasn't accepted various forms of the first option, so I don't think it's a suitable approach for us. The hardening-wrapper package implements the second option and also enforces our existing hardening flags for build systems ignoring CFLAGS/CXXFLAGS/LDFLAGS. All it would take is either adding hardening-wrapper to the default devtools packages list or making it part of base-devel. Here's an example with a small C program: strcat@thinktank i ~ master % cat test.c #include <stdio.h> static void foo() {} static int bar = 5; int main(void) { int baz = 5; printf("function: %p, data: %p, stack: %p\n", foo, &bar, &baz); return 0; } Without the hardening-wrapper package installed: strcat@thinktank i ~ master % gcc test.c -o test strcat@thinktank i ~ master % checksec --file test RELRO STACK CANARY NX PIE RPATH RUNPATH FILE No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH test strcat@thinktank i ~ master % ./test function: 0x400506, data: 0x600980, stack: 0x7fff12ba3a7c strcat@thinktank i ~ master % ./test function: 0x400506, data: 0x600980, stack: 0x7fffa47958fc With the hardening-wrapper package installed: strcat@thinktank i ~ master % gcc test.c -o test strcat@thinktank i ~ master % checksec --file test RELRO STACK CANARY NX PIE RPATH RUNPATH FILE Partial RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH test strcat@thinktank i ~ master % ./test function: 0x7f267e569800, data: 0x7f267e76a050, stack: 0x7fff3ee5ea14 strcat@thinktank i ~ master % ./test function: 0x7f6a06b3e790, data: 0x7f6a06d3f048, stack: 0x7fff76a891bc The defaults in /etc/hardening-wrapper.conf can be overridden via env variables: strcat@thinktank i ~ master % HARDENING_STACK_PROTECTOR=0 gcc test.c -o test strcat@thinktank i ~ master % checksec --file test RELRO STACK CANARY NX PIE RPATH RUNPATH FILE Partial RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH test The need to use wrapper scripts is a bit ugly, but I think it's a nicer approach than tracking down and patching dozens of build systems to respect CFLAGS/LDFLAGS and it's the only realistic way to enable PIE. The only alternative short of patching GCC spec files is manually specifying the flags in thousands of executable-only packages, and patching any build system producing both binaries and libraries (yikes!).

5 14

Re: [arch-dev-public] [arch-commits] Commit in xz/trunk (PKGBUILD)
by Andreas Radke 31 Dec '14

31 Dec '14

What's the plan with xz update? Will you push 5.2.0 with smp support right after the 5.0.8 update? -Andy

2 1

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 31 Dec '14

31 Dec '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 24 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 5 fully signed off packages * 39 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (24 total) == * bash-4.3.033-1 (i686) * iproute2-3.18.0-1 (i686) * bash-4.3.033-1 (x86_64) * iproute2-3.18.0-1 (x86_64) * cabal-install-1.20.0.4-1 (i686) * ecasound-2.9.1-4 (i686) * ghc-7.8.4-1 (i686) * kdebindings-korundum-4.14.3-2 (i686) * kdebindings-qtruby-4.14.3-2 (i686) * rrdtool-1.4.8-5 (i686) * ruby-2.2.0-1 (i686) * subversion-1.8.11-2 (i686) * vim-7.4.560-1 (i686) * weechat-1.0.1-2 (i686) * cabal-install-1.20.0.4-1 (x86_64) * ecasound-2.9.1-4 (x86_64) * ghc-7.8.4-1 (x86_64) * kdebindings-korundum-4.14.3-2 (x86_64) * kdebindings-qtruby-4.14.3-2 (x86_64) * rrdtool-1.4.8-5 (x86_64) * ruby-2.2.0-1 (x86_64) * subversion-1.8.11-2 (x86_64) * vim-7.4.560-1 (x86_64) * weechat-1.0.1-2 (x86_64) == Incomplete signoffs for [core] (5 total) == * bash-4.3.033-1 (i686) 0/1 signoffs * iproute2-3.18.0-1 (i686) 0/1 signoffs * xz-5.0.8-1 (i686) 0/1 signoffs * bash-4.3.033-1 (x86_64) 0/2 signoffs * iproute2-3.18.0-1 (x86_64) 0/2 signoffs == Incomplete signoffs for [extra] (34 total) == * cabal-install-1.20.0.4-1 (i686) 0/1 signoffs * ecasound-2.9.1-4 (i686) 0/1 signoffs * ghc-7.8.4-1 (i686) 0/1 signoffs * kdebindings-korundum-4.14.3-2 (i686) 0/1 signoffs * kdebindings-qtruby-4.14.3-2 (i686) 0/1 signoffs * lirc-1:0.9.1.a-11 (i686) 0/1 signoffs * mplayer-37344-1 (i686) 0/1 signoffs * nvidia-343.36-5 (i686) 0/1 signoffs * nvidia-304xx-304.125-5 (i686) 0/1 signoffs * nvidia-340xx-340.65-6 (i686) 0/1 signoffs * pulseaudio-5.99.2-1 (i686) 0/1 signoffs * qemu-2.2.0-1 (i686) 0/1 signoffs * rrdtool-1.4.8-5 (i686) 0/1 signoffs * ruby-2.2.0-1 (i686) 0/1 signoffs * subversion-1.8.11-2 (i686) 0/1 signoffs * vim-7.4.560-1 (i686) 0/1 signoffs * weechat-1.0.1-2 (i686) 0/1 signoffs * cabal-install-1.20.0.4-1 (x86_64) 0/2 signoffs * ecasound-2.9.1-4 (x86_64) 0/2 signoffs * ghc-7.8.4-1 (x86_64) 0/2 signoffs * kdebindings-korundum-4.14.3-2 (x86_64) 0/2 signoffs * kdebindings-qtruby-4.14.3-2 (x86_64) 0/2 signoffs * lirc-1:0.9.1.a-11 (x86_64) 0/2 signoffs * mplayer-37344-1 (x86_64) 0/2 signoffs * nvidia-343.36-5 (x86_64) 1/2 signoffs * nvidia-304xx-304.125-5 (x86_64) 0/2 signoffs * nvidia-340xx-340.65-6 (x86_64) 0/2 signoffs * pulseaudio-5.99.2-1 (x86_64) 0/2 signoffs * qemu-2.2.0-1 (x86_64) 0/2 signoffs * rrdtool-1.4.8-5 (x86_64) 0/2 signoffs * ruby-2.2.0-1 (x86_64) 0/2 signoffs * subversion-1.8.11-2 (x86_64) 0/2 signoffs * vim-7.4.560-1 (x86_64) 0/2 signoffs * weechat-1.0.1-2 (x86_64) 0/2 signoffs == Completed signoffs (5 total) == * linux-3.18.1-1 (i686) * lz4-127-1 (i686) * linux-3.18.1-1 (x86_64) * lz4-127-1 (x86_64) * xz-5.0.8-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * qemu-2.2.0-1 (i686), since 2014-12-11 * qemu-2.2.0-1 (x86_64), since 2014-12-11 == Top five in signoffs in last 24 hours == 1. dan - 2 signoffs

1 0

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 30 Dec '14

30 Dec '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 0 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 5 fully signed off packages * 15 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == Incomplete signoffs for [core] (1 total) == * xz-5.0.8-1 (i686) 0/1 signoffs == Incomplete signoffs for [extra] (14 total) == * lirc-1:0.9.1.a-11 (i686) 0/1 signoffs * mplayer-37344-1 (i686) 0/1 signoffs * nvidia-343.36-5 (i686) 0/1 signoffs * nvidia-304xx-304.125-5 (i686) 0/1 signoffs * nvidia-340xx-340.65-6 (i686) 0/1 signoffs * pulseaudio-5.99.2-1 (i686) 0/1 signoffs * qemu-2.2.0-1 (i686) 0/1 signoffs * lirc-1:0.9.1.a-11 (x86_64) 0/2 signoffs * mplayer-37344-1 (x86_64) 0/2 signoffs * nvidia-343.36-5 (x86_64) 0/2 signoffs * nvidia-304xx-304.125-5 (x86_64) 0/2 signoffs * nvidia-340xx-340.65-6 (x86_64) 0/2 signoffs * pulseaudio-5.99.2-1 (x86_64) 0/2 signoffs * qemu-2.2.0-1 (x86_64) 0/2 signoffs == Completed signoffs (5 total) == * linux-3.18.1-1 (i686) * lz4-127-1 (i686) * linux-3.18.1-1 (x86_64) * lz4-127-1 (x86_64) * xz-5.0.8-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * qemu-2.2.0-1 (i686), since 2014-12-11 * qemu-2.2.0-1 (x86_64), since 2014-12-11 == Top five in signoffs in last 24 hours ==

1 0

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 29 Dec '14

29 Dec '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 2 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 5 fully signed off packages * 17 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (2 total) == * mplayer-37344-1 (i686) * mplayer-37344-1 (x86_64) == Incomplete signoffs for [core] (1 total) == * xz-5.0.8-1 (i686) 0/1 signoffs == Incomplete signoffs for [extra] (16 total) == * expac-4-3 (i686) 0/1 signoffs * lirc-1:0.9.1.a-11 (i686) 0/1 signoffs * mplayer-37344-1 (i686) 0/1 signoffs * nvidia-343.36-5 (i686) 0/1 signoffs * nvidia-304xx-304.125-5 (i686) 0/1 signoffs * nvidia-340xx-340.65-6 (i686) 0/1 signoffs * pulseaudio-5.99.2-1 (i686) 0/1 signoffs * qemu-2.2.0-1 (i686) 0/1 signoffs * expac-4-3 (x86_64) 0/2 signoffs * lirc-1:0.9.1.a-11 (x86_64) 0/2 signoffs * mplayer-37344-1 (x86_64) 0/2 signoffs * nvidia-343.36-5 (x86_64) 0/2 signoffs * nvidia-304xx-304.125-5 (x86_64) 0/2 signoffs * nvidia-340xx-340.65-6 (x86_64) 0/2 signoffs * pulseaudio-5.99.2-1 (x86_64) 0/2 signoffs * qemu-2.2.0-1 (x86_64) 0/2 signoffs == Completed signoffs (5 total) == * linux-3.18.1-1 (i686) * lz4-127-1 (i686) * linux-3.18.1-1 (x86_64) * lz4-127-1 (x86_64) * xz-5.0.8-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * qemu-2.2.0-1 (i686), since 2014-12-11 * qemu-2.2.0-1 (x86_64), since 2014-12-11 == Top five in signoffs in last 24 hours == 1. foutrelis - 12 signoffs 2. fyan - 3 signoffs

1 0

[arch-dev-public] eric packages renaming
by Evgeniy Alekseev 29 Dec '14

29 Dec '14

Hello, Recently eric-6.0.0 has been released. It is a new major release which provides fully python2/python3 support and supports Qt5 interface as well as Qt4. According to these features I plan to push Qt5 version to [community], I have contacted with upstream some time ago and they said Qt5 version is stable enough. This version will replace old {,python2-}eric packages. But as far as there are a lot of Qt4 based applications in our repo, I plan to continue maintain Qt4 based eric, but these packages will be renamed to eric-qt4 and will be in conflict with Qt5 based eric. I push these changes to [community-testing] in near future if there are no any objections. Then if it will work normally I will move them to [community] after two weeks period. CC'ing to arch-general@ for possible discussion. -- Sincerely yours, Evgeniy Alekseev email: darkarcanis(a)mail.ru ICQ: 407-398-235 Jabber: arcanis(a)jabber.ru

1 0

[arch-dev-public] Namcap maintainer
by keenerd 28 Dec '14

28 Dec '14

Hi devs. With your approval and permission I would like to be added to the maintainers for Namcap. It aligns well with my interests and does not seem to have any active maintainer at present. I'd like to immediately get through the backlog of patches, feature requests and bug reports (mine included). -Kyle http://kmkeen.com

4 6

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 28 Dec '14

28 Dec '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 4 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 7 fully signed off packages * 27 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (4 total) == * lz4-127-1 (i686) * pacman-4.2.0-4 (i686) * lz4-127-1 (x86_64) * pacman-4.2.0-4 (x86_64) == Incomplete signoffs for [core] (9 total) == * lz4-127-1 (i686) 0/1 signoffs * xz-5.0.8-1 (i686) 0/1 signoffs * binutils-2.25-1 (x86_64) 1/2 signoffs * gcc-4.9.2-2 (x86_64) 1/2 signoffs * glibc-2.20-6 (x86_64) 1/2 signoffs * linux-api-headers-3.18.1-1 (x86_64) 1/2 signoffs * lz4-127-1 (x86_64) 0/2 signoffs * pacman-4.2.0-4 (x86_64) 1/2 signoffs * xz-5.0.8-1 (x86_64) 1/2 signoffs == Incomplete signoffs for [extra] (18 total) == * expac-4-3 (i686) 0/1 signoffs * lirc-1:0.9.1.a-11 (i686) 0/1 signoffs * nvidia-343.36-5 (i686) 0/1 signoffs * nvidia-304xx-304.125-5 (i686) 0/1 signoffs * nvidia-340xx-340.65-6 (i686) 0/1 signoffs * pulseaudio-5.99.2-1 (i686) 0/1 signoffs * pyalpm-0.7-1 (i686) 0/1 signoffs * qemu-2.2.0-1 (i686) 0/1 signoffs * system-config-printer-1.5.4-2 (i686) 0/1 signoffs * expac-4-3 (x86_64) 0/2 signoffs * lirc-1:0.9.1.a-11 (x86_64) 0/2 signoffs * nvidia-343.36-5 (x86_64) 0/2 signoffs * nvidia-304xx-304.125-5 (x86_64) 0/2 signoffs * nvidia-340xx-340.65-6 (x86_64) 0/2 signoffs * pulseaudio-5.99.2-1 (x86_64) 0/2 signoffs * pyalpm-0.7-1 (x86_64) 0/2 signoffs * qemu-2.2.0-1 (x86_64) 0/2 signoffs * system-config-printer-1.5.4-2 (x86_64) 0/2 signoffs == Completed signoffs (7 total) == * binutils-2.25-1 (i686) * gcc-4.9.2-2 (i686) * glibc-2.20-6 (i686) * linux-3.18.1-1 (i686) * linux-api-headers-3.18.1-1 (i686) * pacman-4.2.0-4 (i686) * linux-3.18.1-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * qemu-2.2.0-1 (i686), since 2014-12-11 * qemu-2.2.0-1 (x86_64), since 2014-12-11 == Top five in signoffs in last 24 hours == 1. allan - 12 signoffs 2. spupykin - 3 signoffs 3. bluewind - 2 signoffs

1 0

[arch-dev-public] packagekit and dependencies dropped
by Ike Devolder 27 Dec '14

27 Dec '14

I just dropped packagekit and its dependencies. Since there was not a single response to my previous mail I just assume there is no interest at all. Packages maintained by me: - packagekit - apper - packagekit-qt Packages not maintained by my that i have dropped: - gnome-packagekit - mate-applet-sotfupd NOTE: - nautilus seems to have a make dep on packagekit so that needs to be sorted out. TODO: - packagekit in gnome-unstable can be dropped too - gnome-packagekit is in staging All leftover packages are related to gnome-unstable efforts. If someone wants to bring back packagekit, feel free. -- Ike

1 0

[arch-dev-public] Dropping haskell-gtk
by Jelle van der Waa 27 Dec '14

27 Dec '14

Thomas proposed some time ago to use cabal-install for haskell libraries. That is why I propose to drop haskell-gtk and it's buildchain, so we can drop: haskell-gtk haskell-pango haskell-glib haskell-cairo haskell-hashtables I also checked package status and I can not find it there :) [1] I would like to leave just xmonad, xmobar and some other haskell packages in [community]. If no one disagrees, I'll drop the packages tommorow. [1] https://www.archlinux.org/news/managing-haskell-packages-with-ghc-782/ -- Jelle van der Waa

1 0