Skip to content

Latest commit

 

History

History
207 lines (174 loc) · 8.96 KB

201204281229.txt.md

File metadata and controls

207 lines (174 loc) · 8.96 KB
Raw

3.8 如何判断当前系统启用了ASLR

http://scz.617.cn/unix/201204281229.txt

A: scz@nsfocus

有一个内核参数randomize_va_space用于控制系统级ASLR:

0

关闭ASLR

1

mmap base、stack、vdso page将随机化。这意味着.so文件将被加载到随机地址。
链接时指定了-pie选项的可执行程序，其代码段加载地址将被随机化。配置内核
时如果指定了CONFIG_COMPAT_BRK，randomize_va_space缺省为1。此时heap没有
随机化。

2

在1的基础上增加了heap随机化。配置内核时如果禁用CONFIG_COMPAT_BRK，
randomize_va_space缺省为2。

查询randomize_va_space当前设置:

sysctl -n kernel.randomize_va_space

1

cat /proc/sys/kernel/randomize_va_space

1

关闭ASLR:

sysctl -w kernel.randomize_va_space=0

echo 0 > /proc/sys/kernel/randomize_va_space

A: scz@nsfocus

可以用ldd快速判断当前系统是否启用了ASLR:

$ ldd which col linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7ded000) /lib/ld-linux.so.2 (0x80000000) $ ldd which col linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7db5000) /lib/ld-linux.so.2 (0x80000000) $ ldd which col linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7db0000) /lib/ld-linux.so.2 (0x80000000)

注意，本例中有两个so的加载基址未被随机化。

A: Mkrtich Soghomonyan 2011-03-25

$ cat /proc/self/maps > 1.txt $ cat /proc/self/maps > 2.txt $ diff 1.txt 2.txt 4,15c4,15 < b7bb1000-b7db1000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive < b7db1000-b7db2000 rw-p b7db1000 00:00 0 < b7db2000-b7ef2000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so < b7ef2000-b7ef4000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so < b7ef4000-b7ef5000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so < b7ef5000-b7ef8000 rw-p b7ef5000 00:00 0 < b7f09000-b7f0b000 rw-p b7f09000 00:00 0 < b7f0b000-b7f0c000 r-xp b7f0b000 00:00 0 [vdso] < b7f0c000-b7f27000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so < b7f27000-b7f28000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so < b7f28000-b7f29000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so < bfe27000-bfe3d000 rw-p bfe27000 00:00 0 [stack]

b7bfa000-b7dfa000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7dfa000-b7dfb000 rw-p b7dfa000 00:00 0 b7dfb000-b7f3b000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3b000-b7f3d000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3d000-b7f3e000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3e000-b7f41000 rw-p b7f3e000 00:00 0 b7f52000-b7f54000 rw-p b7f52000 00:00 0 b7f54000-b7f55000 r-xp b7f54000 00:00 0 [vdso] b7f55000-b7f70000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b7f70000-b7f71000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b7f71000-b7f72000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bfa6e000-bfa83000 rw-p bfa6e000 00:00 0 [stack]

diff输出表明stack、vsdo page、一些so的地址均被随机化。

$ cat 1.txt 08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7bb1000-b7db1000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7db1000-b7db2000 rw-p b7db1000 00:00 0 b7db2000-b7ef2000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7ef2000-b7ef4000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7ef4000-b7ef5000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7ef5000-b7ef8000 rw-p b7ef5000 00:00 0 b7f09000-b7f0b000 rw-p b7f09000 00:00 0 b7f0b000-b7f0c000 r-xp b7f0b000 00:00 0 [vdso] b7f0c000-b7f27000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b7f27000-b7f28000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b7f28000-b7f29000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bfe27000-bfe3d000 rw-p bfe27000 00:00 0 [stack] $ cat 2.txt 08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7bfa000-b7dfa000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7dfa000-b7dfb000 rw-p b7dfa000 00:00 0 b7dfb000-b7f3b000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3b000-b7f3d000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3d000-b7f3e000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3e000-b7f41000 rw-p b7f3e000 00:00 0 b7f52000-b7f54000 rw-p b7f52000 00:00 0 b7f54000-b7f55000 r-xp b7f54000 00:00 0 [vdso] b7f55000-b7f70000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b7f70000-b7f71000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b7f71000-b7f72000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bfa6e000-bfa83000 rw-p bfa6e000 00:00 0 [stack]

检查原始输出，主映像、heap未被随机化。

关闭ASLR之后再测试一遍:

sysctl -w kernel.randomize_va_space=0

kernel.randomize_va_space = 0

cat /proc/self/maps > 1.txt

cat /proc/self/maps > 2.txt

diff 1.txt 2.txt

diff无输出，表示各内存区域基址未被随机化。

cat 1.txt

08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7c8a000-b7e8a000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7e8a000-b7e8b000 rw-p b7e8a000 00:00 0 b7e8b000-b7fcb000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fcb000-b7fcd000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fcd000-b7fce000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fce000-b7fd1000 rw-p b7fce000 00:00 0 b7fe2000-b7fe4000 rw-p b7fe2000 00:00 0 b7fe4000-b7fe5000 r-xp b7fe4000 00:00 0 [vdso] b7fe5000-b8000000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b8000000-b8001000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b8001000-b8002000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bffeb000-c0000000 rw-p bffeb000 00:00 0 [stack]

内核参数randomize_va_space置0会关闭整个系统的ASLR，有时候只想关闭单个进程 的ASLR，可以用setarch命令实现这点。

$ setarch uname -m -R cat /proc/self/maps > 1.txt $ setarch uname -m -R cat /proc/self/maps > 2.txt $ diff 1.txt 2.txt

diff无输出，表示各内存区域基址未被随机化。

$ cat 1.txt 08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7c8a000-b7e8a000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7e8a000-b7e8b000 rw-p b7e8a000 00:00 0 b7e8b000-b7fcb000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fcb000-b7fcd000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fcd000-b7fce000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fce000-b7fd1000 rw-p b7fce000 00:00 0 b7fe2000-b7fe4000 rw-p b7fe2000 00:00 0 b7fe4000-b7fe5000 r-xp b7fe4000 00:00 0 [vdso] b7fe5000-b8000000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b8000000-b8001000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b8001000-b8002000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bffea000-c0000000 rw-p bffea000 00:00 0 [stack]

D: scz 2012-04-28 16:35

奇怪的是，setarch关闭单个进程ASLR时，stack的地址有时会变，并不总是固定的， 这是什么情况？而内核参数randomize_va_space置0时，就没有观察到这种现象。

$ setarch uname -m -R cat /proc/self/maps > 1.txt $ setarch uname -m -R cat /proc/self/maps > 2.txt $ diff 1.txt 2.txt 15c15 < bffeb000-c0000000 rw-p bffeb000 00:00 0 [stack]

bffea000-c0000000 rw-p bffea000 00:00 0 [stack] $ cat 1.txt 08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7c8a000-b7e8a000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7e8a000-b7e8b000 rw-p b7e8a000 00:00 0 b7e8b000-b7fcb000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fcb000-b7fcd000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fcd000-b7fce000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7fce000-b7fd1000 rw-p b7fce000 00:00 0 b7fe2000-b7fe4000 rw-p b7fe2000 00:00 0 b7fe4000-b7fe5000 r-xp b7fe4000 00:00 0 [vdso] b7fe5000-b8000000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b8000000-b8001000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b8001000-b8002000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bffeb000-c0000000 rw-p bffeb000 00:00 0 [stack]