Question about linking vsftpd with +cond_rodata

[bobjh]

Hello,

I managed to get vsftpd to build on an HP-UX server with gcc and Gnu make by means of about a half-dozen judicious type-casting hacks in sysutil.c and sysdeputil.c. But, in the process, I also had to remove the '-fstack-protector' option from CFLAGS and the '-Wl,-z,relro -Wl,-z,now' options for LDFLAGS. Hopefully, the 'executable_stack' kernel tunable will provide something equivalent to the '-fstack-protector' option. What I'd like to do now is put back the equivalent of the Linux '-z relro' linker option. Does anybody know if the HP linker option '+cond_rodata' will do this?

Thank you!

[Dennis Handly]

>Does anybody know if the HP linker option '+cond_rodata' will do this?

This is a compiler option only available with HP's compilers and is the default under -exec, so it was removed from the doc.

What are you trying to do with: Create an ELF "PT_GNU_RELRO" segment header in the object.

[bobjh]

Thanks. Apparently "-z relro" is a recent Linux security hardening option to "place commonly exploited structures in ELF binaries to a quasi-readonly location".

Alas, I tried connecting to vsftpd via ftp (without SSL enabled) but I get a "500 OOPS: mmap" error, so perhaps the question is moot.

[Dennis Handly · Accepted solution]

>Apparently "-z relro" is a recent Linux security hardening option to "place commonly exploited structures in ELF binaries to a quasi-readonly location".

Then +cond_rodata won't help.

Things are put into text sections only if the compiler and linker can determine they aren't modifiable, typically by the use of const.   Using -exec will also get more things in text if local addresses are taken.

About the only security option is ld/dld +protect option.

[bobjh]

Thank you.