Inferencium/website
1
0
Fork 0
Code Issues Activity

Fix 1st-level heading and section indentation

Browse Source
This commit is contained in:
inference 2024-01-29 20:23:29 +00:00
parent 90911cc33c
commit 67b88c3af1
Signed by: inference
SSH Key Fingerprint: SHA256:FtEVfx1CmTKMy40VwZvF4k+3TC+QhCWy+EmPRg50Nnc
1 changed files with 83 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
documentation/hardened_malloc.xhtml
View File

@ -1,7 +1,7 @@
<!DOCTYPE html> <!DOCTYPE html>
<!-- Inferencium - Website - Documentation - hardened_malloc --> <!-- Inferencium - Website - Documentation - hardened_malloc -->
<!-- Version: 3.0.0-alpha.8 --> <!-- Version: 3.0.0-alpha.9 -->
<!-- Copyright 2023 Jake Winters --> <!-- Copyright 2023 Jake Winters -->
<!-- SPDX-License-Identifier: BSD-3-Clause --> <!-- SPDX-License-Identifier: BSD-3-Clause -->
@ -27,16 +27,18 @@
<div><a href="../directory.xhtml">Directory</a></div> <div><a href="../directory.xhtml">Directory</a></div>
<div><a href="../key.xhtml">Key</a></div> <div><a href="../key.xhtml">Key</a></div>
</nav> </nav>
<h1 id="hardened_malloc"><a href="#hardened_malloc">Documentation - hardened_malloc</a></h1>
<section id="introduction"> <section id="introduction">
<h1 id="introduction"><a href="#introduction">Documentation - hardened_malloc</a></h1>
<p>This documentation contains instructions to use <p>This documentation contains instructions to use
<a href="https://github.com/GrapheneOS/hardened_malloc">hardened_malloc</a> <a href="https://github.com/GrapheneOS/hardened_malloc">hardened_malloc</a>
memory allocator as the system's default memory allocator. These instructions apply to memory allocator as the system's default memory allocator. These instructions
both musl and glibc C libraries on Unix-based and Unix-like systems.</p> apply to both musl and glibc C libraries on Unix-based and Unix-like
<p>hardened_malloc can also be used per-application and/or per-user, in which case root systems.</p>
permissions are not required; this documentation focuses on system-wide usage of <p>hardened_malloc can also be used per-application and/or per-user, in which
hardened_malloc, assumes root privileges, and assumes the compiled library will be case root permissions are not required; this documentation focuses on
located in a path readable and executable by all users of the system.</p> system-wide usage of hardened_malloc, assumes root privileges, and assumes the
compiled library will be located in a path readable and executable by all users
of the system.</p>
<p>For the complete hardened_malloc documentation, visit its <p>For the complete hardened_malloc documentation, visit its
<a href="https://github.com/GrapheneOS/hardened_malloc#hardened_malloc">official documentation</a>.</p> <a href="https://github.com/GrapheneOS/hardened_malloc#hardened_malloc">official documentation</a>.</p>
<p>This documentation is also available in portable AsciiDoc format in my <p>This documentation is also available in portable AsciiDoc format in my
@ -56,8 +58,8 @@
<section id="memory_pages"> <section id="memory_pages">
<h2 id="memory_pages"><a href="#memory_pages">Increase Permitted Amount of Memory Pages</a></h2> <h2 id="memory_pages"><a href="#memory_pages">Increase Permitted Amount of Memory Pages</a></h2>
<p>Add <code>vm.max_map_count = 1048576</code> to <p>Add <code>vm.max_map_count = 1048576</code> to
<code>/etc/sysctl.conf</code> to accommodate hardened_malloc's large amount of guard <code>/etc/sysctl.conf</code> to accommodate hardened_malloc's large amount of
pages.</p> guard pages.</p>
</section> </section>
<section id="clone_source_code"> <section id="clone_source_code">
<h2 id="clone_source_code"><a href="#clone_source_code">Clone hardened_malloc Source Code</a></h2> <h2 id="clone_source_code"><a href="#clone_source_code">Clone hardened_malloc Source Code</a></h2>
@ -71,24 +73,26 @@
<h2 id="compile"><a href="#compile">Compile hardened_malloc</a></h2> <h2 id="compile"><a href="#compile">Compile hardened_malloc</a></h2>
<p><code>$ make <var>&lt;arguments&gt;</var></code></p> <p><code>$ make <var>&lt;arguments&gt;</var></code></p>
<p><code>CONFIG_N_ARENA=<var>n</var></code> can be adjusted to increase parallel <p><code>CONFIG_N_ARENA=<var>n</var></code> can be adjusted to increase parallel
performance at the expense of memory usage, or decrease memory usage at the expense of performance at the expense of memory usage, or decrease memory usage at the
parallel performance, where <var>n</var> is an integer. Higher values prefer parallel expense of parallel performance, where <var>n</var> is an integer. Higher values
performance, whereas lower values prefer lower memory usage. Note that having too many prefer parallel performance, whereas lower values prefer lower memory usage.
arenas may cause memory fragmentation and decrease system performance. The number of Note that having too many arenas may cause memory fragmentation and decrease
arenas has no impact on the security properties of hardened_malloc.</p> system performance. The number of arenas has no impact on the security
properties of hardened_malloc.</p>
<p><b>Minimum number of arenas:</b> 1</p> <p><b>Minimum number of arenas:</b> 1</p>
<p><b>Maximum number of arenas:</b> 256</p> <p><b>Maximum number of arenas:</b> 256</p>
<p>For extra security, <code>CONFIG_SEAL_METADATA=true</code> can be used in order to <p>For extra security, <code>CONFIG_SEAL_METADATA=true</code> can be used in
control whether Memory Protection Keys are used to disable access to all writable order to control whether Memory Protection Keys are used to disable access to
allocator state outside of the memory allocator code. It's currently disabled by default all writable allocator state outside of the memory allocator code. It's
due to a significant performance cost for this use case on current-generation hardware. currently disabled by default due to a significant performance cost for this use
Whether or not this feature is enabled, the metadata is all contained within an isolated case on current-generation hardware. Whether or not this feature is enabled, the
memory region with high-entropy random guard regions around it.</p> metadata is all contained within an isolated memory region with high-entropy
<p>For low-memory systems, <code>VARIANT=light</code> can be used to compile the light random guard regions around it.</p>
variant of hardened_malloc, which sacrifices some security for much less memory <p>For low-memory systems, <code>VARIANT=light</code> can be used to compile the
usage. This option still produces a more hardened memory allocator than both the light variant of hardened_malloc, which sacrifices some security for much less
default musl and glibc allocators, despite the security sacrifices over the full memory usage. This option still produces a more hardened memory allocator than
variant.</p> both the default musl and glibc allocators, despite the security sacrifices over
the full variant.</p>
<p>For all compile-time options, see the <p>For all compile-time options, see the
<a href="https://github.com/GrapheneOS/hardened_malloc#configuration">configuration section</a> <a href="https://github.com/GrapheneOS/hardened_malloc#configuration">configuration section</a>
of hardened_malloc's extensive official documentation.</p> of hardened_malloc's extensive official documentation.</p>