{"id":34721,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","title":{"rendered":"Planuri pentru \u00eent\u0103rirea mecanismului de protec\u021bie W^X \u00een OpenBSD.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Teo De Raad <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-tech&#038;m=155899373514678&#038;w=2\">a fost \u00eemp\u0103rt\u0103\u0219it\u0103 de<\/a><\/noindex> planuri privind \u00eent\u0103rirea mecanismului de protec\u021bie a memoriei W^X (Write XOR Execute). Esen\u021ba mecanismului este c\u0103 paginile de memorie ale procesului nu pot fi accesate simultan pentru scriere \u0219i execu\u021bie. Astfel, codul poate fi executat doar dup\u0103 interdic\u021bia scrierii, iar scrierea \u00een pagina de memorie este posibil\u0103 doar dup\u0103 interdic\u021bia execu\u021biei. Mecanismul W^X ajut\u0103 la protejarea aplica\u021biilor \u00een spa\u021biul utilizatorului \u00eempotriva atacurilor tipice realizate prin overflow de buffer, inclusiv \u00eempotriva overflow-urilor de stiv\u0103 \u0219i este activ \u00een OpenBSD. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44506\">implicit<\/a><\/noindex>.<\/p>\n<p>De la \u00eenceputul lucr\u0103rilor la W^X a fost clar c\u0103 este un drum lung, deoarece exist\u0103 un num\u0103r semnificativ de aplica\u021bii care utilizeaz\u0103 JIT. Implement\u0103rile JIT pot fi \u00eemp\u0103r\u021bite \u00een trei categorii:<\/p>\n<ul>\n<li class=\"l\"> Comut\u00e2nd memoria \u00eentre st\u0103rile W \u0219i X, accept\u00e2nd &#171;costul&#187; apelului de sistem <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/mprotect.2\">mprotect<\/a><\/noindex>.\n<li class=\"l\"> Cre\u00e2nd aliasuri \u00eentre pereche de h\u0103r\u021bi W \u0219i X ale acelea\u0219i memorii.\n<li class=\"l\"> Cea mai &#171;murdar\u0103&#187; variant\u0103 \u2014 modelele de memorie W|X, care permit realizarea simultan\u0103 a scrierii \u0219i execu\u021biei.\n<\/ul>\n<p>\u00cen prezent, au r\u0103mas semnificativ mai pu\u021bine programe care utilizeaz\u0103 a treia variant\u0103 \u0219i mai multe care folosesc prima \u0219i a doua. Cu toate acestea, deoarece a fost necesar s\u0103 se ruleze \u0219i programe cu W|X JIT (\u00een principal, Chromium \u0219i Iridum), a fost ad\u0103ugat\u0103 op\u021biunea de a monta sistemul de fi\u0219iere &#171;wxallowed&#187;, care permite utilizarea memoriei simultan pentru scriere \u0219i execu\u021bie, \u00een cazul \u00een care fi\u0219ierul ELF executabil este marcat cu &#171;wxneeded&#187;, iar aplica\u021biile \u00een sine sunt protejate suplimentar folosind mecanismele <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43295\">pledge<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49042\">unveil<\/a><\/noindex> pentru restric\u021bionarea listei apelurilor de sistem utilizate \u0219i a p\u0103r\u021bilor sistemului de fi\u0219iere disponibile aplica\u021biei \u00een consecin\u021b\u0103.<\/p>\n<p>Pentru a complica \u0219i mai mult exploatarea vulnerabilit\u0103\u021bilor \u00een astfel de aplica\u021bii, a fost propus un supliment al mecanismului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48243\">MAP_STACK<\/a><\/noindex>, care verific\u0103 dac\u0103 apelul de sistem este efectuat dintr-o pagin\u0103 de memorie accesibil\u0103 pentru scriere. Dac\u0103 pagina este accesibil\u0103 pentru scriere, procesul este terminat for\u021bat. Astfel, atacatorul nu va putea folosi apelurile de sistem \u0219i va fi nevoit s\u0103 \u00eencerce s\u0103 g\u0103seasc\u0103 gadgeturi necesare \u00een implementarea JIT sau chiar s\u0103 execute o munc\u0103 mai dificil\u0103 pentru a descoperi stub-uri ale apelurilor de sistem direct \u00een interiorul <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44320\">libc-ului legat \u00eent\u00e2mpl\u0103tor.<\/a><\/noindex>. <\/p>\n<p>Procesele Chrome\/Iridium sunt deja protejate destul de eficient prin intermediul pledge \u0219i unveil, \u00eens\u0103 restric\u021bionarea accesului la apeluri sistemice precum write(2) are avantajele sale, \u00eentruc\u00e2t creeaz\u0103 dificult\u0103\u021bi suplimentare pentru atacatori. Totu\u0219i, aceste dificult\u0103\u021bi pot ap\u0103rea \u0219i \u00een cazul \u00een care implementarea JIT utilizeaz\u0103 apeluri sistemice native din memoria W|X. Cu toate acestea, exist\u0103 motive s\u0103 credem c\u0103 nu ne vom confrunta cu a\u0219a ceva, deoarece ABI-ul a fost modificat de mai multe ori, dar nimeni nu a raportat vreodat\u0103 probleme.<\/p>\n<p>Modific\u0103rile sunt deja disponibile \u00een instantanee regulate din ramura OpenBSD-Curent, to\u021bi cei interesa\u021bi sunt invita\u021bi s\u0103 participe la testare.<\/p>\n<p>Un comentariu aparte din partea lui Theo merit\u0103 \u0219tirile legate de introducerea \u00een Chrome\/Iridium a modului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50559\">JITless<\/a><\/noindex>. Din perspectiva sa, aceasta este acceptabil\u0103 pentru anumite modele de utilizare, totu\u0219i, probabil nu pentru toate, deoarece \u00een acest mod va cre\u0219te evident sarcina pe procesor. \u00cen prezent, Chrome va func\u021biona \u00een principal dac\u0103 se dezactiveaz\u0103 &#171;wxallowed&#187; pentru \\\/usr\\\/local, de\u0219i pot ap\u0103rea probleme cu anumite extensii (de exemplu, ghostery). Oricum, Theo sper\u0103 c\u0103 func\u021bionarea complet\u0103 \u00een modul JITless va fi adus\u0103 la un stadiu complet opera\u021bional \u00een cur\u00e2nd.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50763\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute). \u0421\u0443\u0442\u044c \u043c\u0435\u0445\u043d\u0438\u0437\u043c\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0438\u0441\u0438, \u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c W^X \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34721","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Planuri de consolidare a mecanismului de protec\u021bie W^X \u00een OpenBSD | ProHoster","description":"Theo De Raadt a \u00eemp\u0103rt\u0103\u0219it planurile de consolidare a mecanismului de protec\u021bie a memoriei W^X (Write XOR Execute).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster","og:description":"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34721","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=34721"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34721\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=34721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=34721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=34721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}