mirror of
https://github.com/GrapheneOS/hardened_malloc.git
synced 2025-11-03 17:26:32 +01:00
Compare commits
4 commits
b61b96bcd8
...
e82a66a162
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e82a66a162 | ||
|
|
de4df3d119 | ||
|
|
ffcfeee69f | ||
|
|
ff99511eb4 |
3 changed files with 13 additions and 10 deletions
19
README.md
19
README.md
|
|
@ -65,14 +65,14 @@ used instead as this allocator fundamentally doesn't support that environment.
|
||||||
|
|
||||||
## Dependencies
|
## Dependencies
|
||||||
|
|
||||||
Debian stable (currently Debian 12) determines the most ancient set of
|
Debian stable (currently Debian 13) determines the most ancient set of
|
||||||
supported dependencies:
|
supported dependencies:
|
||||||
|
|
||||||
* glibc 2.36
|
* glibc 2.41
|
||||||
* Linux 6.1
|
* Linux 6.12
|
||||||
* Clang 14.0.6 or GCC 12.2.0
|
* Clang 19.1.7 or GCC 14.2.0
|
||||||
|
|
||||||
For Android, the Linux GKI 5.10, 5.15 and 6.1 branches are supported.
|
For Android, the Linux GKI 6.1, 6.6 and 6.12 branches are supported.
|
||||||
|
|
||||||
However, using more recent releases is highly recommended. Older versions of
|
However, using more recent releases is highly recommended. Older versions of
|
||||||
the dependencies may be compatible at the moment but are not tested and will
|
the dependencies may be compatible at the moment but are not tested and will
|
||||||
|
|
@ -83,7 +83,7 @@ there will be custom integration offering better performance in the future
|
||||||
along with other hardening for the C standard library implementation.
|
along with other hardening for the C standard library implementation.
|
||||||
|
|
||||||
For Android, only the current generation, actively developed maintenance branch of the Android
|
For Android, only the current generation, actively developed maintenance branch of the Android
|
||||||
Open Source Project will be supported, which currently means `android15-release`.
|
Open Source Project will be supported, which currently means `android16-release`.
|
||||||
|
|
||||||
## Testing
|
## Testing
|
||||||
|
|
||||||
|
|
@ -159,8 +159,11 @@ line to the `/etc/ld.so.preload` configuration file:
|
||||||
The format of this configuration file is a whitespace-separated list, so it's
|
The format of this configuration file is a whitespace-separated list, so it's
|
||||||
good practice to put each library on a separate line.
|
good practice to put each library on a separate line.
|
||||||
|
|
||||||
On Debian systems `libhardened_malloc.so` should be installed into `/usr/lib/`
|
For maximum compatibility `libhardened_malloc.so` can be installed into
|
||||||
to avoid preload failures caused by AppArmor profile restrictions.
|
`/usr/lib/` to avoid preload failures caused by AppArmor profiles or systemd
|
||||||
|
ExecPaths= restrictions. Check for logs of the following format:
|
||||||
|
|
||||||
|
ERROR: ld.so: object '/usr/local/lib/libhardened_malloc.so' from /etc/ld.so.preload cannot be preloaded (failed to map segment from shared object): ignored.
|
||||||
|
|
||||||
Using the `LD_PRELOAD` environment variable to load it on a case-by-case basis
|
Using the `LD_PRELOAD` environment variable to load it on a case-by-case basis
|
||||||
will not work when `AT_SECURE` is set such as with setuid binaries. It's also
|
will not work when `AT_SECURE` is set such as with setuid binaries. It's also
|
||||||
|
|
|
||||||
|
|
@ -44,7 +44,7 @@ void *set_pointer_tag(void *ptr, u8 tag) {
|
||||||
return (void *) (((uintptr_t) tag << 56) | (uintptr_t) untag_pointer(ptr));
|
return (void *) (((uintptr_t) tag << 56) | (uintptr_t) untag_pointer(ptr));
|
||||||
}
|
}
|
||||||
|
|
||||||
// This test checks that slab slot allocation uses tag that is distint from tags of its neighbors
|
// This test checks that slab slot allocation uses tag that is distinct from tags of its neighbors
|
||||||
// and from the tag of the previous allocation that used the same slot
|
// and from the tag of the previous allocation that used the same slot
|
||||||
void tag_distinctness() {
|
void tag_distinctness() {
|
||||||
// tag 0 is reserved
|
// tag 0 is reserved
|
||||||
|
|
|
||||||
|
|
@ -98,7 +98,7 @@ class TestSimpleMemoryCorruption(unittest.TestCase):
|
||||||
self.assertEqual(stderr.decode("utf-8"),
|
self.assertEqual(stderr.decode("utf-8"),
|
||||||
"fatal allocator error: invalid free\n")
|
"fatal allocator error: invalid free\n")
|
||||||
|
|
||||||
def test_invalid_malloc_usable_size_small_quarantene(self):
|
def test_invalid_malloc_usable_size_small_quarantine(self):
|
||||||
_stdout, stderr, returncode = self.run_test(
|
_stdout, stderr, returncode = self.run_test(
|
||||||
"invalid_malloc_usable_size_small_quarantine")
|
"invalid_malloc_usable_size_small_quarantine")
|
||||||
self.assertEqual(returncode, -6)
|
self.assertEqual(returncode, -6)
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue