Re: [PATCH/ezannoni_pie-20040323-branch] New branch and pie

[Ian Lance Taylor <ian@wasabisystems.com>]

Eli Zaretskii <eliz@elta.co.il> writes:

> > From: Elena Zannoni <ezannoni@redhat.com>
> > Date: Tue, 23 Mar 2004 23:03:22 -0500
> > 
> > I gave up updating the old branch that I had created for PIE work.
> > I just created a new one: ezannoni_pie-20040323-branch.
> 
> Thanks.
> 
> Any pointers to previous discussions of the reason(s) for this?  I
> cannot say I understand what is this supposed to do.

Are you asking about what PIE is supposed to do, or something abour
Elena's support for it?

PIE is a hack to make executables more secure.  The theory is that
worms attack your system by causing a stack overrun on your program
and by controlling what they write onto the stack.  In an ordinary
executable, the worm code can know precisely where the executable is
located in memory, and they can take advantage of that fact to let the
stack overrun code call into the executable directly.  Using PIE means
that the worm can not successfully call into the executable, because
it doesn't know what location to call.

I think it's kind of a desperation move, personally.  It's trivial for
a worm to make direct system calls.

I would be all for PIE if it were free or nearly free, but it's not.
It makes the executable larger, and it adds relocations which make the
executable slower to load.

This is in contract to exec-shield-randomize, for example, which
randomizes the sbrk and stack address so that worms can't rely on a
particular stack location when executing.  As protection against worms
this is very nearly useless, but it's also pretty much free, so I
think it's a good idea.

Ian