On Sun, Dec 07, 2014 at 12:55:05AM +0100, Matteo Panella wrote:
> That said, the static linking approach is kinda... well... ok, it sucks
> - both from a bloat standpoint (no page sharing among processes - it
> might not be a big deal on bare metal, but on a memory-constrained VM it
> *is* a big deal)

This is a problem if you have to deal with black boxes and with non-Unix
software, that is, your programs use memory as IPC bus. IMHO static linking
doesn't sucks that much, it just enforces muh freedum and puts a big
constraint to a dev: he has to use real IPC means and shatter the system in
separate binaries, launched as different processes (concurrent processes which
load the same binaries share the same text segment, so there's not that load
of bloat).
And if an attacker can log what your machine passes between fd or sockets,
you're fucked even dlopening everything...

> and from a security standpoint (as I said, security
> issues down the stack trickle all the way to the top when it comes to
> update management - also static executables have their address space
> layout set in stone at compile time, which isn't exactly a good thing
> nowadays).

grsecurity solves this issue for Linux, randomizing the address space during
loading [1]. OpenBSD ships ASLR out of the box.
Did, on dynamic linking side, GNU ldd solve that issue that made it run any
type of code whatsoever instead? [2]


[1] http://pax.grsecurity.net/docs/aslr.txt
[2] https://www.catonmat.net/blog/ldd-arbitrary-code-execution/

--
Teodoro Santoni