Re: dietlibc broken on i386 since Feb 2018?

> > That only works if none of your code is compiled with -fstack-protector.
> > Otherwise the binaries will segfault.
> Hmmm... I thought that diet executable is NOT compiled with it. That was one
> of the reasons I was wondering.

Unfortunately this is not something you can do on the fly. The libc has
to be compiled with support for it, or not. This means doing additional
stuff in the startup code, namely initialize one variable to a random
value, and it has to be real randomness for security reasons.

The way dietlibc does this is take the randomness the kernel hands it,
and there really is no other good way to do it, that is why this is
turned on by default. The alternative is to read from /dev/urandom, but
that can fail in chroot environments or if the file table is full. What
then? Abort the binary? That is clearly also bad.

The only recommendable fix is to tell people to use a kernel which
supports passing randomness.

Newer kernels also have a system call to get randomness, but that was
added even later so it does not help with this problem.

> > 2.6.18 was released in 2006.
> > If that is not ancient then what is?
> haha... I thought that sysenter was introduced even long before that - and
> this is still configurable in dietfeatures. ;-)

So is this feature.

What is your point?

Felix