0

G “Guard”. Enable guard pages. Each page size or larger allocation is followed by a guard page that will cause a segmentation fault upon any access

How can I enable guard pages to harden an OpenBSD install?

Also, how can I check what is the current status of the malloc settings?

In http://man.openbsd.org/malloc.conf.5 I can see:

Set a systemwide reduction of the cache to a quarter of the default size and use guard pages:

# ln -s 'G<<' /etc/malloc.conf

This probably enabled guard pages, but what is the "<<" and the "reduction of the cache to a quarter of the default size".

I just want to enable guard pages, afaik that is the most secure setting for malloc.conf.

  • Years ago, this was done by a library called ElectricFence by Bruce Perens that you could use as a replacement malloc on any system with mmap. It had run-time options never to free a page, and to align allocations with the end of a page rather than beginning to better detect overruns versus underruns – Kaz Sep 26 '16 at 20:01
  • update: there is no way, maybe write own code to check :) – Peter84753 Oct 22 '16 at 18:37
2

Excerpts from the man page which you link:

 G       ``Guard''.  Enable guard pages.  Each page size or larger
         allocation is followed by a guard page that will cause a
         segmentation fault upon any access.

 <       ``Half the cache size''.  Decrease the size of the free page
         cache by a factor of two.

 The default number of free pages cached is 64.

Hence, the symbolic link you create at /etc/malloc.conf enables guard page, and reduces the cache size by a factor of 4, presumably from 64 pages to 16 pages.

If you just want to enable guard pages without modifying the cache size, just

# ln -s G /etc/malloc.conf
  • why do they modify the cache size? does it helps regarding security? Thanks!! – Peter84753 Sep 26 '16 at 18:52
  • so I missed that in the man pages, thanks, but how can I get the status of the malloc conf? only by testing? with what? paxtest? – Peter84753 Sep 27 '16 at 6:53
  • use ls -l /etc/malloc.conf to see the current setting, or rm /etc/malloc.conf to remove it. To verify behaviour, I'd probably write a quick-and-dirty test to malloc various size blocks and read/write at various offsets beyond the returned block. – user4556274 Sep 27 '16 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.