Re: problem resolving foreign function (I think)
DJ <[email protected]> Tue, 17 Mar 2015 20:41:08 -0400
| Newsgroups | gmane.lisp.clsql.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1204817652==
Content-Type: multipart/alternative;
boundary="------------090107030601020500080809"
This is a multi-part message in MIME format.
--------------090107030601020500080809
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
On 15-03-12 10:21 AM, Russ Tyndall wrote:
> I played with my development environment and tried loading with only=20
> quicklisp libraries. On the latest quicklisp (clsql-20150302), I can=20
> load :clsql-mysql by simply quickloading it on my Ubuntu 14.04. It=20
> takes care of all the building / loading aspects correctly. There=20
> were some problems with load flags in previous versions that have been=20
> fixed (somewhat) recently.
Russ:
I have done a bit of work on this. As I said earlier, my expertise is=20
limited, but I may (possibly) have found a problem.
I tinkered with the load flags for building clsql_mysql64.so. I=20
discovered that the shared library does not work with ccl if built with=20
the -pie load flag. (The other flags seem to be ok.)
I see that the -pie flag is set for ld because of this line in=20
db-mysql/Makefile:
LDFLAGS:=3D$(LDFLAGS) $(shell env
DEB_BUILD_MAINT_OPTIONS=3Dhardening=3D+all dpkg-buildflags --get LDFL=
AGS
| sed "s/-Wl\|,/ /ig")
From experimenting I see that setting "hardening=3D+all" causes=20
dpkg-buildflags to output -pie (and perhaps others I ignored) that are=20
not there by default.
If I simply eliminate the -pie flag, it appears that I can at least load=20
the library into ccl and resolve the foreign functions in the shared=20
library.
I note that the man page for dpkg-buildflags seems to indicate that -pie=20
is not compatible with -fPIC. However the -fPIC flag is indeed set as a=20
gcc compile flag for the shared library. Here is the excerpt from the=20
dpkg-buildflags man page I am referring to (important part bold):
pie This setting (disabled by default) adds -fPIE to=20
CFLAGS and
CXXFLAGS, and -fPIE -pie to LDFLAGS. Position=20
Independent Exe=E2=80=90
cutable are needed to take advantage of Address Space =20
Layout
Randomization, supported by some kernel versions. While=20
ASLR can
already be enforced for data areas in the stack and=20
heap (brk
and mmap), the code areas must be compiled as=20
position-indepen=E2=80=90
dent. Shared libraries already do this (-fPIC), so=20
they gain
ASLR automatically, but binary .text regions need to=20
be build
PIE to gain ASLR. When this happens, ROP (Return=20
Oriented Pro=E2=80=90
gramming) attacks are much harder since there are no=20
static
locations to bounce off of during a memory corruption atta=
ck.
* This is not compatible with -fPIC so care must be =20
taken when**
** building shared objects.*
--------------090107030601020500080809
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta content=3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Ty=
pe">
</head>
<body bgcolor=3D"#FFFFFF" text=3D"#000000">
<br>
<br>
<div class=3D"moz-cite-prefix">On 15-03-12 10:21 AM, Russ Tyndall
wrote:<br>
</div>
<blockquote cite=3D"mid:[email protected]" type=3D"ci=
te">
<meta content=3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-=
Type">
I played with my development environment and tried loading with
only quicklisp libraries.=C2=A0 On the latest quicklisp
(clsql-20150302), I can load :clsql-mysql by simply quickloading
it on my Ubuntu 14.04.=C2=A0 It takes care of all the building /
loading aspects correctly.=C2=A0 There were some problems with load
flags in previous versions that have been fixed (somewhat)
recently.=C2=A0 <br>
</blockquote>
Russ:<br>
<br>
I have done a bit of work on this. As I said earlier, my expertise
is limited, but I may (possibly) have found a problem.<br>
<br>
I tinkered with the load flags for building clsql_mysql64.so. I
discovered that the shared library does not work with ccl if built
with the -pie load flag. (The other flags seem to be ok.)<br>
<br>
I see that the -pie flag is set for ld because of this line in
db-mysql/Makefile:<br>
<br>
<blockquote>LDFLAGS:=3D$(LDFLAGS) $(shell env
DEB_BUILD_MAINT_OPTIONS=3Dhardening=3D+all dpkg-buildflags --get
LDFLAGS | sed "s/-Wl\|,/ /ig")<br>
<br>
</blockquote>
From experimenting I see that setting "hardening=3D+all" causes
dpkg-buildflags to output -pie (and perhaps others I ignored) that
are not there by default.<br>
<br>
If I simply eliminate the -pie flag, it appears that I can at least
load the library into ccl and resolve the foreign functions in the
shared library.<br>
<br>
I note that the man page for dpkg-buildflags seems to indicate that
-pie is not compatible with -fPIC. However the -fPIC flag is indeed
set as a gcc compile flag for the shared library. Here is the
excerpt from the dpkg-buildflags man page I am referring to
(important part bold):<br>
<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 pie=C2=A0=C2=A0=C2=A0 This setti=
ng (disabled by default)=C2=A0 adds=C2=A0 -fPIE=C2=A0 to=C2=A0
CFLAGS=C2=A0 and<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 CXXFLAGS,=C2=A0 and=C2=A0 -fPIE -pie to LDFLAGS. Position
Independent Exe=E2=80=90<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 cutable are needed to take advantage=C2=A0 of=C2=A0 Address=C2=A0
Space=C2=A0 Layout<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 Randomization, supported by some kernel versions.
While ASLR can<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 already be enforced for data areas in the stack=C2=A0 and=C2=A0
heap=C2=A0 (brk<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 and=C2=A0 mmap), the code areas must be compiled as
position-indepen=E2=80=90<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 dent. Shared libraries already do this=C2=A0 (-fPIC),=C2=A0 so=C2=
=A0
they=C2=A0 gain<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 ASLR=C2=A0 automatically,=C2=A0 but=C2=A0 binary .text regions =
need
to be build<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 PIE to gain ASLR. When this happens, ROP (Return=C2=A0
Oriented=C2=A0 Pro=E2=80=90<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 gramming)=C2=A0 attacks=C2=A0 are=C2=A0 much=C2=A0 harder=C2=A0=
since there are
no static<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 locations to bounce off of during a memory corruption
attack.<br>
<br>
<b>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 This is not compatible with -fPIC so care=C2=A0 must=C2=A0
be=C2=A0 taken=C2=A0 when</b><b><br>
</b><b>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 building shared objects.</b><br>
<br>
</body>
</html>
--------------090107030601020500080809--
--===============1204817652==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
CLSQL mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/clsql
--===============1204817652==--