- Debugger: Getting mixed signals
- 'Packaging Infrastructure' Contract Weekly Report #4
- Haiku monthly activity report - 06/2015
- 'Packaging Infrastructure' Contract Weekly Report #3
- 'Packaging Infrastructure' Contract Weekly Report #2
- GCI 2014 winners trip report (mentor side)
- TeX Live and LyX; Changes to the boot code
- 'Packaging Infrastructure' Contract Weekly Report #1
- Beginning of 'Packaging Infrastructure' Contract
- Haiku monthly activity report - 05/2015
ASLR and DEP implemented
Starting with hrev45522 address space layout randomization (ASLR) and data execution prevention (DEP) are available in Haiku. These two features, which have actually become a standard in any modern OS, make it much harder to exploit any vulnerability that may be present in an application running on Haiku thus generally improve system security.
DEP requires hardware support, but since it is not a cutting edge technology anymore any Athlon 64 (or later) or later versions of Pentium 4 would suffice. Haiku automatically determines whether it is available. The main advantage of DEP is that, very common in the past, attacks based on stack buffer overflows are no longer trivial virtually making system safe against such kind of vulnerabilities.
Second feature, ASLR, does not require hardware support and is always enabled. All areas in application address space are at random locations making stack based overflows even harder to exploit. Moreover, ASLR is very good at making return to library attacks impractical and in general making the system behavior less predictable for the potential attacker.
- Paweł Dziepak's blog
- Login or register to post comments

Comments
Re: ASLR and DEP implemented
It is nice to see examples of how Haiku is moving forward! This sure qualifies as moving forward. I do not know that much about (ASLR) or (DEP). However, I think it is a good plan to take care of this sort of thing before it becomes a problem.
Security can be a bit of a problem in a single-user OS. I am pleased to see these features added to Haiku so that maybe problems can for the most part be avoided! Good job, Paweł Dziepak
ddavid123
Re: ASLR and DEP implemented
Impressive work, well done!
Re: ASLR and DEP implemented
This is good, thank you. :)