On Sun, Mar 12, 2023 at 11:06:58PM +0000, Thomas Weißschuh wrote: > On Sun, Mar 12, 2023 at 01:56:43PM +0100, Willy Tarreau wrote: > > Hi Thomas, > > > > thanks for this patchset. I must confess it's not very clear to me which > > class of programs using nolibc could benefit from stack protection, but > > if you think it can improve the overall value (even if just by allowing > > to test more combinations), I'm fine with this given that it doesn't > > remove anything. > > I forgot the rationale, will add it properly to the next revision: > > This is useful when using nolibc for security-critical tools. > Using nolibc has the advantage that the code is easily auditable and > sandboxable with seccomp as no unexpected syscalls are used. > Using compiler-assistent stack protection provides another security > mechanism. I hadn't thought about such a use case at all. Till now the code has been developped in a more or less lenient way because it was aimed at tiny tools (a small preinit code, and regtests) with no particular focus on security. I'm fine with such use cases but I think we need to place the cursor at the right place in terms of responsibilities between the lib and the application. For example IMHO we should make sure it's never the lib's responsibility to erase some buffers that might have contained a password, to provide constant-time memcmp(), nor to pad/memset the structures in functions stacks, otherwise it will significantly complicate contributions and reviews in the future. This means the lib should continue to focus on providing convenient access to syscalls and very basic functions and if certain security- sensitive functions are ever needed, we should probably refrain from implementing them so that users know it's their job to provide them for their application. I don't have any such function in mind but I prefer that we can draw this line early. But I definitely understand how such a model based on inlined code can provide some benefits in terms of code auditing! You can even copy the code in the application's repository and have everything available without even depending on any version so that once the code has been audited, you know it will not change by a iota. Makes sense! Thanks for the background, Willy
