{"id":34721,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","title":{"rendered":"Plaadid W^X kaitsemehhanismi tugevdamiseks OpenBSD-s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Theo De Raadt <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-tech&#038;m=155899373514678&#038;w=2\">jagatud<\/a><\/noindex> W^X (Write XOR Execute) m\u00e4lu kaitse mehhanismi tugevdamise plaanid. Mehhanismi olemus seisneb selles, et protsessi m\u00e4lulehed ei saa olla samal ajal kirjutamiseks ja t\u00e4itmiseks ligip\u00e4\u00e4setavad. Seega saab koodi t\u00e4ita ainult p\u00e4rast kirjutamise lubamise l\u00f5petamist ning kirjutamine m\u00e4lu lehe sisse on v\u00f5imalik ainult p\u00e4rast t\u00e4itmise keeldumist. W^X mehhanism aitab kaitsta kasutajaruumi rakendusi t\u00fc\u00fcpiliste r\u00fcnnakute eest, mis on teostatud m\u00e4lupuhverduste \u00fclekoormuse kaudu, sealhulgas ka virna \u00fclekoormuste eest ja on aktiivne OpenBSD-s. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44506\">vaikimisi<\/a><\/noindex>.<\/p>\n<p>W^X-ga t\u00f6\u00f6tamise algusest oli selge, et see on pikk tee, kuna on m\u00e4rkimisv\u00e4\u00e4rne hulk rakendusi, mis kasutavad JIT-i. JIT-i rakendusi saab jagada kolme kategooriasse:<\/p>\n<ul>\n<li class=\"l\"> L\u00fclitades m\u00e4lu W ja X olekute vahel, leppides s\u00fcsteemi kutsumise \"maksumusega\". <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/mprotect.2\">mprotect<\/a><\/noindex>.\n<li class=\"l\"> Loovad pseudon\u00fc\u00fcmid W ja X kahe sama m\u00e4lu kaardistuse vahel.\n<li class=\"l\"> K\u00f5ige \"mustem\" variant \u2014 W|X m\u00e4lu mudel, mis n\u00f5uab salvestamise ja t\u00e4itmise samaaegset teostamist.\n<\/ul>\n<p>Praegu on m\u00e4rgatavalt v\u00e4hem programme, mis kasutavad kolmandat varianti, ja rohkem, mis kasutavad esimest ja teist. Siiski, kuna oli vaja k\u00e4ivitada ka W|X JIT programme (peamiselt Chromium ja Iridium), lisati failis\u00fcsteemi mountimise valik \"wxallowed\", mis v\u00f5imaldas m\u00e4lu kasutada samaaegselt nii kirjutamiseks kui ka t\u00e4itmiseks, juhul kui k\u00e4ivitatav ELF-fail on m\u00e4rgitud \"wxneeded\" markeriga, ning rakendusi kaitsti t\u00e4iendavalt mehhanismide abil. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43295\">pledge<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49042\">unveil<\/a><\/noindex> s\u00fcsteemik\u00f5nede kasutamise loendi ja rakendusele kergesti ligip\u00e4\u00e4setavate failis\u00fcsteemi osade piiramiseks.<\/p>\n<p>Haavatavuse \u00e4rakasutamise edasiseks keerukamaks muutmiseks sarnastes rakendustes on ette pandud mehhanismi t\u00e4iendus. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48243\">MAP_STACK<\/a><\/noindex>, mis kontrollib, kas s\u00fcsteemik\u00f5ne toimub kirjutatavast m\u00e4lulehest. Kui leht on kirjutatav, l\u00f5petatakse protsess sunniviisiliselt. Nii ei saa r\u00fcndaja kasutada s\u00fcsteemik\u00f5nesid ja peab proovima leida vajalikke seadmeid JIT-i rakenduses v\u00f5i isegi tegema keerulisemat t\u00f6\u00f6d, et avastada s\u00fcsteemik\u00f5nede plokke otse. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44320\">juhuslikult seotud libc<\/a><\/noindex>. <\/p>\n<p>Chrome\/Iridium protsessid on piisavalt h\u00e4sti kaitstud pledge ja unveil abil, kuid n\u00e4iteks write(2) s\u00fcsteemik\u00f5ne kasutamise keelamine annab ilmselgelt teatud eelise, kuna see tekitab r\u00fcndajale t\u00e4iendavaid raskusi. Siiski v\u00f5ivad raskused tekkida ka juhul, kui JIT-i rakendus kasutab natiivseid s\u00fcsteemik\u00f5nesid W|X m\u00e4lust. Kuid on p\u00f5hjust loota, et sellise probleemiga ei pea kokku puutuma, kuna ABI on korduvalt muutunud, kuid keegi pole kunagi probleemidest teatanud.<\/p>\n<p>Muutused on juba saadaval OpenBSD-Ccurrent haru regulaarsetes snapshotides, k\u00f5ik huvilised on kutsutud testima.<\/p>\n<p>Teo on kommentaari v\u00f5rra t\u00e4helepanuv\u00e4\u00e4rsed uudised Chrome'i\/Iridiumi re\u017eiimi ilmumise kohta <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50559\">JITless<\/a><\/noindex>Tema seisukohalt on see m\u00f5ne kasutusmudeli jaoks vastuv\u00f5etav, kuid t\u00f5en\u00e4oliselt mitte k\u00f5igi jaoks, kuna selles re\u017eiimis suureneb ilmselgelt protsessorikoormus. Praegu t\u00f6\u00f6tab Chrome peamiselt, kui \"wxallowed\" on keelatud \/usr\/local jaoks, kuigi m\u00f5ned laiendustega nagu ghostery v\u00f5ivad esineda probleeme. Igatahes loodab Theo, et JITless-re\u017eiimi t\u00e4ie\u00f5iguslik t\u00f6\u00f6 viiakse peatselt t\u00e4ielikult toimivasse seisu.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50763\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute). \u0421\u0443\u0442\u044c \u043c\u0435\u0445\u043d\u0438\u0437\u043c\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0438\u0441\u0438, \u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c W^X \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34721","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Plaanid W^X mehhanismi tugevdamiseks OpenBSD-s | ProHoster","description":"Teo De Raadt jagas plaane m\u00e4lu kaitsemehhanismi W^X (Write XOR Execute) tugevdamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster","og:description":"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34721","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34721"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34721\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}