1

OpenBSD has great security mitigations too, ex.: W^X: https://en.wikipedia.org/wiki/W%5EX

But, the /usr/local FS needs to have "wxallowed" mount option because of Google Chrome, because it won't start without it.

"wxallowed" disables the W^X on the given FS.

The Question: does Google Chrome has this seriously bad quality code, that it needs wxallowed, or is this something more complex?

Ex. good example: Firefox simply works without the wxallowed option, so it uses the W^X mitigation, which is great.

But another bad example: LibreOffice doesn't starts without wxallowed too..

  • To find all the port that requires wxallowed, use find /usr/ports/ -type f -name 'Makefile*' -exec grep -F USE_WXNEEDED {} +. There are currently 52 such ports, including the ones you have mentioned, MongoDB, Node, Ruby, Python (some of the extensions) and Qt 4/5. I'm not sure it's a sign of "bad quality code", but it is not good practice, for sure. – Kusalananda Feb 4 '18 at 20:42
  • A proper answer should probably actually show (or describe) what Chromium or another program does to require disabling W^X protection. – Kusalananda Feb 4 '18 at 21:01
  • I am trying to ask it at: stackoverflow.com/questions/48631646/… for LibreOffice. But I don't have too much points on Stackoverflow to put a bug bounty on it :\ Thanks for the hints! – Hessnov Feb 5 '18 at 21:19
  • If you feel brave, ask on the OpenBSD ports list. – Kusalananda Feb 5 '18 at 21:25
2

There are a bunch of problematic ports as @Kusalananda points out; I cannot speak for all of them though suspect a major issue is just-in-time compiled code. This is code compiled after the program begins; this code must be written somewhere so it can then be executed; this breaks W^X as the page where that code was written to cannot also be executed from. The easy fix is to set wxallowed to allow this to happen. The hard fix is to rewrite the code to support both JIT and on W^X memory pages (possible drawbacks, besides the effort to create that code include slow-downs of the JIT+W^X code, which may be problematical for software users expect to be performant).

Someone would need to look at each port, review the code, possibly make extensive changes depending on how amenable the code is to never executing from a writable page, test those changes. Some software will likely require much work, others perhaps lack the people hours (or will, or money) for someone to implement the changes. There's no way to tell how bad an application is at mixing the memory without reviewing it, so lack of W^X may or may not be an indication of "bad code quality."

JIT+W^X happened fairly recently for firefox.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.