Re: How to test for FORTIFY_SOURCE?
Hi Luke, Luke A. Call wrote on Wed, Mar 18, 2020 at 12:54:10PM -0600: > On 03-18 19:22, Ingo Schwarze wrote: >> Theo de Raadt wrote: >>> Ingo -- I think using man.openbsd.org as a "testbed for all possible >>> man page hierarchies" incorrect. >> It was never a testbed, but a production service with several parts >> provided nowhere else (well, at least until FreeBSD followed our >> lead and started providing something very similar). >> >> For example, for DragonFly, Illumos, and NetBSD, semantic searching >> is neither supported by their native apropos(1) on the command line >> nor by their own websites. >> >> But since you have a point that such services hardly belong >> on *.openbsd.org, they are now on *.bsd.lv, where misunderstandings >> like the one witnessed above are unlikely to happen. > Providing a simple link from the man.openbsd.org page to the services > on *.bsd.lv might help those who are used to looking in the old > location, while avoiding possible "which bsd" confusion (maybe called > "Some other systems' manuals", or such). Especially for those not > reading this thread. Just a thought. Makes sense, done. Note that in addition to man.openbsd.org, man.bsd.lv is now also up and running, but the latter will only contain release manual pages for a number of systems (including OpenBSD) but not OpenBSD-current. Yours, Ingo
Re: How to test for FORTIFY_SOURCE?
Wed, 18 Mar 2020 11:55:53 -0400 Jeffrey Walton > On Wed, Mar 18, 2020 at 11:25 AM Andreas Kusalananda Kähäri > wrote: > > > > On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote: > > > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson > > > wrote: > > > > > > > > On 2020-03-18, Jeffrey Walton wrote: > > > > > According to > > > > > https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > > > > > OpenBSD implements glibc bounds checking on certain functions. I am > > > > > trying to detect FORTIFY_SOURCE without looking up operating system > > > > > names and versions. > > > > > > > > That is a NetBSD manual page, it does not apply to OpenBSD. > > > > > > Thanks. > > > > > > I may be splitting hairs, but the pages title clearly says it is an > > > OpenBSD man page. > > > > I have no real connection to the OpenBSD project other than being a long > > time user, and I have an interest in documentation. > > > > It says, at the top of the page, it says "OpenBSD manual page server", > > i.e. it's a manual page server hosted by the OpenBSD project. The > > link that you mention contains the string "NetBSD-8.1" and the name > > of the manual that you're looking at is "security — NetBSD security > > features". Also, "NetBSD-8.1" is repeated in the page footer and the > > string "NetBSD" occurs many times throughout the page while "OpenBSD" > > really only occurs once. > > Hovering the mouse over the open tab says "security(7) - OpenBSD man > pages". I double checked it when I saw the references to NetBSD. > > Regarding the references to NetBSD, I thought your sed went sideways. > I assumed OpenBSD and NetBSD were collaborating and shared code and > docs in some places. > > Figuring out why the sed was broken was not my task at hand. I was on > the site to figure out why my test for FORTIFY_SOURCE was failing. The > admins can figure that out why the document conversion is not working > they notice it. > > Jeff > Hi Jeffrey, I find the ability to check other manual pages so valuable. People are aware when they make a mistake, it's theirs for not checking what they are actually looking at. Instead of blaming the service available for confusing them like it's so popular online these days. The confusion is yours, just please don't request service degradation for the rest of us because ot that. These online manual pages are useful, let's all keep our eyes open and honest about it ;-) Kind regards, Anton Lazarov MScEng EECSIT
Re: How to test for FORTIFY_SOURCE?
On 03-18 20:29, Ingo Schwarze wrote: > I have definitely collaborated with at least these NetBSD developers > in the past: And a lame but sincere thanks to Ingo, Theo, and everyone else, for the impressive work freely given, and for patiently tolerating the rest of us.
Re: How to test for FORTIFY_SOURCE?
Hi, Theo de Raadt wrote on Wed, Mar 18, 2020 at 12:44:03PM -0600: > Ingo Schwarze wrote: >> Jeffrey Walton wrote on Wed, Mar 18, 2020 at 11:55:53AM -0400: >>> I assumed OpenBSD and NetBSD were collaborating and shared code >>> and docs in some places. >> To a limited extent, that is true. > To a limited extent, it is true that birds and fish are friends. > > In other words, it is untrue. There isn't collaboration. I have definitely collaborated with at least these NetBSD developers in the past: * Joerg Sonnenberger (joerg@) * Thomas Klausner (wiz@) * Christos Zoulas (christos@) "Collaboration" in the sense that there was consistent working together on joint projects for months, with Joerg even for years. Besides, Sevan Janiyan (sevan@) has been one of the most prolific mandoc release testers for four years now, to the point that i might call that collaboration. Eight other NetBSD developers have provided minor contributions over the years, the overall effect of which also feels like systematic collaboration to me. Similar effects exist for FreeBSD (bapt@) and Debian (stapelberg@) and to a lesser degree for Illumos (Yuri Pankov) and Void Linux (Leah Neukirchen). I even attended a mini-hackathon organized by a NetBSD developer in the past, and the code both the NetBSD developer and i wrote there is still part of both OpenBSD and NetBSD. That is certainly worth being called collaboration. > And there isn't sharing. At best there is freely given stuff which > is sometimes taken. I propose not using the word "share" since people > may believe it is one of the stronger meanings of the word. At best > it is the weakest meaning. It seems true that "freely give" is not as easily misunderstood as "share". Yours, Ingo
Re: How to test for FORTIFY_SOURCE?
On 03-18 19:22, Ingo Schwarze wrote: > > Ingo -- I think using man.openbsd.org as a "testbed for all possible > > man page hierarchies" incorrect. > > It was never a testbed, but a production service with several parts > provided nowhere else (well, at least until FreeBSD followed our > lead and started providing something very similar). > > For example, for DragonFly, Illumos, and NetBSD, semantic searching > is neither supported by their native apropos(1) on the command line > nor by their own websites. > > But since you have a point that such services hardly belong > on *.openbsd.org, they are now on *.bsd.lv, where misunderstandings > like the one witnessed above are unlikely to happen. Providing a simple link from the man.openbsd.org page to the services on *.bsd.lv might help those who are used to looking in the old location, while avoiding possible "which bsd" confusion (maybe called "Some other systems' manuals", or such). Especially for those not reading this thread. Just a thought. -- Luke Call My thoughts: http://lukecall.net (updated 2020-03-13)
Re: How to test for FORTIFY_SOURCE?
Ingo Schwarze wrote: > Hi Jeffrey, > > Jeffrey Walton wrote on Wed, Mar 18, 2020 at 11:55:53AM -0400: > > > I assumed OpenBSD and NetBSD were collaborating and shared code and > > docs in some places. > > To a limited extent, that is true. To a limited extent, it is true that birds and fish are friends. In other words, it is untrue. There isn't collaboration. And there isn't sharing. At best there is freely given stuff which is sometimes taken. I propose not using the word "share" since people may believe it is one of the stronger meanings of the word. At best it is the weakest meaning.
Re: How to test for FORTIFY_SOURCE?
Hi Jeffrey, Jeffrey Walton wrote on Wed, Mar 18, 2020 at 11:55:53AM -0400: > I assumed OpenBSD and NetBSD were collaborating and shared code and > docs in some places. To a limited extent, that is true. For example, NetBSD includes mandoc(1) which is predominantly developed on OpenBSD while OpenBSD includes editline(7) which is predominantly developed on NetBSD. But that doesn't mean either system slavishly copies changes from the other, nor that components both contain work in exactly the same way. Developers of both systems use their own judgement to decide what to merge from the other system, and when. So please do use the documentation from the right system even for those components that are very similar on both, or you will sooner or later stumble over some subtle difference. Yours, Ingo
Re: How to test for FORTIFY_SOURCE?
Hi Theo, Theo de Raadt wrote on Wed, Mar 18, 2020 at 09:06:25AM -0600: > Jeffrey Walton wrote: >> What is the purpose of supplying man pages for the wrong operating >> system? The purpose is to make it simpler to compare how different systems work without having to jump back and forth among different sites using different URI schemes and running different software. Also, the man.cgi(8) from the mandoc toolset is way better than the software running on netbsd.gw.com, leaf.dragonflybsd.org, illumos.org, and man7.org, which provide neither semantic searching nor tagging/deep linking of comparable quality. Note that www.freebsd.org now also runs the man.cgi(8) from the mandoc toolset - after several years hoping to switch to it, they finally did it. >> It wastes people's time and breaks search. This search does >> not produce expected results: >> https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org. Do not search the web for software documentation. That's a bad idea in the first place. You are likely to end up with documentation for the wrong version of the software in question, which is exactly what happened to you here. Use autoritative documentation for the system you are interested in, instead. >> If you really want to confuse folks, maybe OpenSD can supply >> Windows man pages. > I'm going to stand up and agree. You have a point that non-OpenBSD manual pages are better served from the *portable* mandoc site than from man.openbsd.org. So i just deleted the non-OpenBSD lines from manpath.conf on man.openbsd.org. For now, comparing different systems can be done here: https://mandoc.bsd.lv/cgi-bin/man.cgi/ That URI is quite ugly, i'll try to figure out whether i can move that to simply man.bsd.lv. > Ingo -- I think using man.openbsd.org as a "testbed for all possible > man page hierarchies" incorrect. It was never a testbed, but a production service with several parts provided nowhere else (well, at least until FreeBSD followed our lead and started providing something very similar). For example, for DragonFly, Illumos, and NetBSD, semantic searching is neither supported by their native apropos(1) on the command line nor by their own websites. But since you have a point that such services hardly belong on *.openbsd.org, they are now on *.bsd.lv, where misunderstandings like the one witnessed above are unlikely to happen. Yours, Ingo
Re: How to test for FORTIFY_SOURCE?
On 2020/03/18 11:55, Jeffrey Walton wrote: > On Wed, Mar 18, 2020 at 11:25 AM Andreas Kusalananda Kähäri > wrote: > > > > On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote: > > > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson > > > wrote: > > > > > > > > On 2020-03-18, Jeffrey Walton wrote: > > > > > According to > > > > > https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > > > > > OpenBSD implements glibc bounds checking on certain functions. I am > > > > > trying to detect FORTIFY_SOURCE without looking up operating system > > > > > names and versions. > > > > > > > > That is a NetBSD manual page, it does not apply to OpenBSD. > > > > > > Thanks. > > > > > > I may be splitting hairs, but the pages title clearly says it is an > > > OpenBSD man page. > > > > I have no real connection to the OpenBSD project other than being a long > > time user, and I have an interest in documentation. > > > > It says, at the top of the page, it says "OpenBSD manual page server", > > i.e. it's a manual page server hosted by the OpenBSD project. The > > link that you mention contains the string "NetBSD-8.1" and the name > > of the manual that you're looking at is "security — NetBSD security > > features". Also, "NetBSD-8.1" is repeated in the page footer and the > > string "NetBSD" occurs many times throughout the page while "OpenBSD" > > really only occurs once. > > Hovering the mouse over the open tab says "security(7) - OpenBSD man > pages". I double checked it when I saw the references to NetBSD. > > Regarding the references to NetBSD, I thought your sed went sideways. > I assumed OpenBSD and NetBSD were collaborating and shared code and > docs in some places. > > Figuring out why the sed was broken was not my task at hand. I was on > the site to figure out why my test for FORTIFY_SOURCE was failing. The > admins can figure that out why the document conversion is not working > they notice it. > > Jeff Since OpenBSD does not have FORTIFY_SOURCE it is correct that your test for it is failing on OpenBSD.
Re: How to test for FORTIFY_SOURCE?
On Wed, Mar 18, 2020 at 11:25 AM Andreas Kusalananda Kähäri wrote: > > On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote: > > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson > > wrote: > > > > > > On 2020-03-18, Jeffrey Walton wrote: > > > > According to > > > > https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > > > > OpenBSD implements glibc bounds checking on certain functions. I am > > > > trying to detect FORTIFY_SOURCE without looking up operating system > > > > names and versions. > > > > > > That is a NetBSD manual page, it does not apply to OpenBSD. > > > > Thanks. > > > > I may be splitting hairs, but the pages title clearly says it is an > > OpenBSD man page. > > I have no real connection to the OpenBSD project other than being a long > time user, and I have an interest in documentation. > > It says, at the top of the page, it says "OpenBSD manual page server", > i.e. it's a manual page server hosted by the OpenBSD project. The > link that you mention contains the string "NetBSD-8.1" and the name > of the manual that you're looking at is "security — NetBSD security > features". Also, "NetBSD-8.1" is repeated in the page footer and the > string "NetBSD" occurs many times throughout the page while "OpenBSD" > really only occurs once. Hovering the mouse over the open tab says "security(7) - OpenBSD man pages". I double checked it when I saw the references to NetBSD. Regarding the references to NetBSD, I thought your sed went sideways. I assumed OpenBSD and NetBSD were collaborating and shared code and docs in some places. Figuring out why the sed was broken was not my task at hand. I was on the site to figure out why my test for FORTIFY_SOURCE was failing. The admins can figure that out why the document conversion is not working they notice it. Jeff
Re: How to test for FORTIFY_SOURCE?
On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote: > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson wrote: > > > > On 2020-03-18, Jeffrey Walton wrote: > > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > > > OpenBSD implements glibc bounds checking on certain functions. I am > > > trying to detect FORTIFY_SOURCE without looking up operating system > > > names and versions. > > > > That is a NetBSD manual page, it does not apply to OpenBSD. > > Thanks. > > I may be splitting hairs, but the pages title clearly says it is an > OpenBSD man page. I have no real connection to the OpenBSD project other than being a long time user, and I have an interest in documentation. It says, at the top of the page, it says "OpenBSD manual page server", i.e. it's a manual page server hosted by the OpenBSD project. The link that you mention contains the string "NetBSD-8.1" and the name of the manual that you're looking at is "security — NetBSD security features". Also, "NetBSD-8.1" is repeated in the page footer and the string "NetBSD" occurs many times throughout the page while "OpenBSD" really only occurs once. > > What is the purpose of supplying man pages for the wrong operating > system? It wastes people's time and breaks search. This search does > not produce expected results: > https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org. > > If you really want to confuse folks, maybe OpenSD can supply Windows man > pages. > > Jeff It's debatable whether the manuals for systems other than OpenBSD should be hosted at man.openbsd.org, but citing "confusion" is probably not a reason to stop providing these. If you want uptodate manuals for the system that you're using, I hope that you're using the man(1) command on the command line and taht you don't rely on the correctness of manuals found on the web. I don't think Windows has manuals in man or mandoc format that are free to host. -- Andreas (Kusalananda) Kähäri SciLifeLab, NBIS, ICM Uppsala University, Sweden .
Re: How to test for FORTIFY_SOURCE?
On 3/18/20 3:59 PM, Jeffrey Walton wrote: > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson wrote: >> >> On 2020-03-18, Jeffrey Walton wrote: >>> According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE >>> OpenBSD implements glibc bounds checking on certain functions. I am >>> trying to detect FORTIFY_SOURCE without looking up operating system >>> names and versions. >> >> That is a NetBSD manual page, it does not apply to OpenBSD. > > Thanks. > > I may be splitting hairs, but the pages title clearly says it is an > OpenBSD man page. > > What is the purpose of supplying man pages for the wrong operating > system? It wastes people's time and breaks search. This search does > not produce expected results: > https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org. > > If you really want to confuse folks, maybe OpenSD can supply Windows man > pages. > > Jeff > What do you mean? Do you mean "OpenBSD manual page server", which clearly states OpenBSD's the just the server. >From the NAME section: "security — NetBSD security features" >From the DESCRIPTION section: "NetBSD supports a variety of security features" >From the footer: "May 21, 2016 NetBSD-8.1" On the entire page OpenBSD is only mentioned once, NetBSD 16 times, not including the drop down menu allowing you to select your operating system + version of choice. To me this feels similar to someone coming to the list and asking why they can't find snmpctl on their OpenBSD 6.6 machine, because some search engine send them to a 6.5 or older page.
Re: How to test for FORTIFY_SOURCE?
Jeffrey Walton wrote: > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson wrote: > > > > On 2020-03-18, Jeffrey Walton wrote: > > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > > > OpenBSD implements glibc bounds checking on certain functions. I am > > > trying to detect FORTIFY_SOURCE without looking up operating system > > > names and versions. > > > > That is a NetBSD manual page, it does not apply to OpenBSD. > > Thanks. > > I may be splitting hairs, but the pages title clearly says it is an > OpenBSD man page. > > What is the purpose of supplying man pages for the wrong operating > system? It wastes people's time and breaks search. This search does > not produce expected results: > https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org. > > If you really want to confuse folks, maybe OpenSD can supply Windows man > pages. I'm going to stand up and agree. Ingo -- I think using man.openbsd.org as a "testbed for all possible man page hierarchies" incorrect.
Re: How to test for FORTIFY_SOURCE?
On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson wrote: > > On 2020-03-18, Jeffrey Walton wrote: > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > > OpenBSD implements glibc bounds checking on certain functions. I am > > trying to detect FORTIFY_SOURCE without looking up operating system > > names and versions. > > That is a NetBSD manual page, it does not apply to OpenBSD. Thanks. I may be splitting hairs, but the pages title clearly says it is an OpenBSD man page. What is the purpose of supplying man pages for the wrong operating system? It wastes people's time and breaks search. This search does not produce expected results: https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org. If you really want to confuse folks, maybe OpenSD can supply Windows man pages. Jeff
Re: How to test for FORTIFY_SOURCE?
On 2020-03-18, Jeffrey Walton wrote: > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE > OpenBSD implements glibc bounds checking on certain functions. I am > trying to detect FORTIFY_SOURCE without looking up operating system > names and versions. That is a NetBSD manual page, it does not apply to OpenBSD.
How to test for FORTIFY_SOURCE?
According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
OpenBSD implements glibc bounds checking on certain functions. I am
trying to detect FORTIFY_SOURCE without looking up operating system
names and versions.
The following code works for Linux, but fails under OpenBSD (it is
part of an autoconf test):
#include
int main(int argc, char** argv)
{
[char msg[16];]
#[strcpy(msg, argv[0]);]
#[return (int)(msg[0] & ~msg[1]);]
[memcpy(msg, argv[0], strlen(argv[0]));]
[return msg[0] != msg[strlen(argv[0])-1];]
}
I then compile it and scan for the fortified function call:
if $CC -D_FORTIFY_SOURCE=2 $CPPFLAGS -O2 $CFLAGS fortify_test.c -o
fortify_test.exe;
then
count=`readelf --relocs fortify_test.exe | grep -i -c '_chk'`
if test "$count" -ne 0; then
AC_MSG_RESULT([yes]); NSD_CPPFLAGS="$NSD_CPPFLAGS -D_FORTIFY_SOURCE=2"
else
AC_MSG_RESULT([no])
fi
fi
The problem is, OpenBSD is not using the fortified function even
though the destination buffer size can be deduced:
$ readelf --relocs fortify_test.exe | grep -i -c '_chk'
0
And:
$ readelf --relocs fortify_test.exe
Relocation section '.rela.dyn' at offset 0x488 contains 2 entries:
Offset Info Type Sym. ValueSym. Name + Addend
2168 0008 R_X86_64_RELATIVE13e0
2160 00030006 R_X86_64_GLOB_DAT
_Jv_RegisterClasses + 0
Relocation section '.rela.plt' at offset 0x4b8 contains 7 entries:
Offset Info Type Sym. ValueSym. Name + Addend
2188 00010007 R_X86_64_JUMP_SLO _csu_finish + 0
2190 00020007 R_X86_64_JUMP_SLO exit + 0
2198 00030007 R_X86_64_JUMP_SLO
_Jv_RegisterClasses + 0
21a0 00040007 R_X86_64_JUMP_SLO atexit + 0
21a8 00050007 R_X86_64_JUMP_SLO strlen + 0
21b0 00060007 R_X86_64_JUMP_SLO memcpy + 0
21b8 00070007 R_X86_64_JUMP_SLO
__stack_smash_handler + 0
I expect to see memcpy_chk or strcpy_chk.
Do I have a misunderstanding of OpenBSD's implementation?
If someone could point out what is wrong I would greatly appreciate it.
