From 8568212eb4373d0dd74b5fa502aad4add539023f Mon Sep 17 00:00:00 2001 From: Theo de Raadt Date: Mon, 29 Aug 2022 17:00:31 +0000 Subject: Dynamically link these /sbin daemons: dhcpleased, mountd, nfsd, pflogd, resolvd, slaacd, unwind. The mitigation story is way better: syscalls are in a randomly located libc, and every syscall stub is randomly located inside that due to random relinking. As opposed to fixed offset inside a release binary. There is one known consequence: /usr nfs mounting must use statically configured IP addresses. ok kettenis florian, others --- sbin/resolvd/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'sbin/resolvd') diff --git a/sbin/resolvd/Makefile b/sbin/resolvd/Makefile index 96281056e63..5ec376f123a 100644 --- a/sbin/resolvd/Makefile +++ b/sbin/resolvd/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.1 2021/02/24 18:10:41 florian Exp $ +# $OpenBSD: Makefile,v 1.2 2022/08/29 17:00:30 deraadt Exp $ PROG= resolvd SRCS= resolvd.c @@ -14,3 +14,6 @@ CFLAGS+= -Wshadow -Wpointer-arith -Wcast-qual CFLAGS+= -Wsign-compare .include + +# Don't compile resolvd as static binary by default +LDSTATIC= -- cgit v1.2.3