ProPolice OpenDarwin7.2.1

UPDATE : This page has been superceded by ssp-darwin.
Patches are currently being developed to work with DarwinBuild and will support Apple's GCC 3.3 ( OS ) 3.5 ( OS ) and possibly 4.
Work is also being done to have support in the kernel, LibC as well as a port of LibSSP.
Hopefully this should tie in with a future OpenDarwin release. Watch this space.

This is an initial release of my ProPolice patch for OpenDarwin

This patch is for gcc which comes with OpenDarwin 7.2.1 ( Apple's gcc-1495, ) which differs from FSF's gcc.

Diff for OpenDarwin 7.2.1 gcc can be found here

Incoming : Diff for Apple gccfast-1614

You will need a copy of the OpenDarwin 7.2.1 release source from the OpenDarwin CVS

% cd /usr/src % cvs -d :pserver:anonymous@anoncvs.opendarwin.org:/Volumes/src/cvs/od co -r OD_RELEASE_7_2_1 src/gcc

Warning : src/gcc is no longer available from OpenDarwin, to continue to use this patch you will require Apple's gcc-1495

Destructions :

The following will build and install in /usr/local/pp.
Alternatively you can build "the Apple way" by following the instructions in /usr/bin/gcc/README.Apple.
Please note that the 2 approaches produce differing results.
If you are using gcc-1495 instead of the one from OpenDarwin7.2.1, you will need to rename gcc-1495 to gcc before applying the patch.
Although the gccfast-1614 patch works, you will need to build Apple's way and have a patched version of gcc-1495 already installed.
You will need to rename gccfast-1614 to gccfast before patching.

% cd /usr/src % patch -p0 < darwin7.2.1gcc-propolice.diff % cd gcc % mkdir darwin % cd darwin % ../configure --prefix=/usr/local/pp % make bootstrap % make install prefix=/usr/local/pp

Add /usr/local/pp/bin to the start of your $path

Test and report back.

How to tell if it is working ?

Download this test program
nb. when compiling with Apple's GCC4 the stack gap is slightly larger as this test program demonstrates.
I mention this so that you are aware of the difference.
Future versions of FSF GCC should include a modified SSP.
This will hopefully be pushed into Apple's tree.

% /usr/pp/bin/gcc overflow.c % ./a.out : segmentation fault ./a.out % gdb ./a.out

GNU gdb 5.3-20030128 (Apple version gdb-292) (Fri Jun 11 03:04:33 UTC 2004) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "powerpc-apple-darwin". Reading symbols for shared libraries .. done (gdb) r Starting program: /Users/samh/a.out Reading symbols for shared libraries +. done

Program received signal EXC_BAD_ACCESS, Could not access memory. 0x41424344 in ?? () (gdb) quit

% /usr/pp2/bin/gcc -fstack-protector overflow.c % ./a.out ; echo $1 : stack smashing attack in function main % gdb ./a.out

DISCLAIMER :

Please note that this is not a complete security solution in itself.

From the web

My original posting

Reply from fkr@ ( release engineer for OpenDarwin 7.2.1 ) ... and my response

Conformation of success on x86 ... and my response

Hello world !!