--- wikisrc/pkgsrc/hardening.mdwn 2017/06/25 16:01:07 1.12 +++ wikisrc/pkgsrc/hardening.mdwn 2017/06/25 16:11:04 1.13 @@ -149,7 +149,7 @@ as opposed to the following binary, buil The latter result is then what is expected. -## Checking for RELRO +## Checking for partial RELRO The following command should list a section called `RELRO`: @@ -161,6 +161,21 @@ The following command should list a sect [...] RELRO off 0x0000000000000d78 vaddr 0x0000000000600d78 paddr 0x0000000000600d78 align 2**0 +## Checking for full RELRO + +The dynamic loader will apply RELRO immediately when detecting the presence of +the `BIND_NOW` flag: + + $ objdump -x /path/to/bin/ary + + /path/to/bin/ary: file format elf64-x86-64 + + Dynamic Section: + [...] + BIND_NOW 0x0000000000000000 + +This has to be combined with partial RELRO (see above) to be fully efficient. + ## Checking for SSP Building objects, binaries and libraries with SSP will affect the presence of