Inferencium/website
1
0
Fork 0
Code Issues Activity

Update webpage "Documentation - hardened_malloc" from version 1.0.1+12 to 1.0.2+21

Browse Source
This commit is contained in:
inference 2023-10-11 14:45:52 +01:00
parent 71099b7db2
commit 68f6b74fd3
Signed by: inference
SSH Key Fingerprint: SHA256:FtEVfx1CmTKMy40VwZvF4k+3TC+QhCWy+EmPRg50Nnc
1 changed files with 55 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
documentation/hardened_malloc.html
View File

@ -5,7 +5,7 @@
<!-- Copyright 2023 Jake Winters --> <!-- Copyright 2023 Jake Winters -->
<!-- SPDX-License-Identifier: BSD-3-Clause --> <!-- SPDX-License-Identifier: BSD-3-Clause -->
<!-- Version: 1.0.1+12 --> <!-- Version: 1.0.2+21 -->
<html> <html>
@ -14,6 +14,7 @@
<link rel="stylesheet" href=../main.css> <link rel="stylesheet" href=../main.css>
<meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="viewport" content="width=device-width, initial-scale=1">
</head> </head>
<body>
<!-- Navigation bar --> <!-- Navigation bar -->
<div class="sidebar"> <div class="sidebar">
<a href="../index.html"><img src="../asset/img/logo-inferencium-no_text.png" width="110px" height="110px"></a> <a href="../index.html"><img src="../asset/img/logo-inferencium-no_text.png" width="110px" height="110px"></a>
@ -28,18 +29,18 @@
<div><a href="../key.html">Key</a></div> <div><a href="../key.html">Key</a></div>
<div><a href="../changelog.html">Changelog</a></div> <div><a href="../changelog.html">Changelog</a></div>
</div> </div>
<body>
<section id="introduction"> <section id="introduction">
<h1 id="introduction"><a href="#introduction">Documentation - GrapheneOS hardened_malloc</a></h1> <h1 id="introduction"><a href="#introduction">Documentation - GrapheneOS hardened_malloc</a></h1>
<p>This documentation contains instructions to use <p>This documentation contains instructions to use
<a href="https://github.com/GrapheneOS/hardened_malloc">GrapheneOS hardened_malloc</a> <a href="https://github.com/GrapheneOS/hardened_malloc">GrapheneOS hardened_malloc</a>
memory allocator as the system's default memory allocator. These instructions apply to both musl memory allocator as the system's default memory allocator. These instructions apply to
and glibc C libraries on Unix-based and Unix-like systems. hardened_malloc can also be used both musl and glibc C libraries on Unix-based and Unix-like systems. hardened_malloc can
per-application and/or per-user, in which case root permissions are not required; this also be used per-application and/or per-user, in which case root permissions are not
documentation focuses on system-wide usage of hardened_malloc, assumes root privileges, and required; this documentation focuses on system-wide usage of hardened_malloc, assumes
assumes the compiled library will be located in a path readable by all users of the system.</p> root privileges, and assumes the compiled library will be located in a path readable by
all users of the system.</p>
<p>For the complete hardened_malloc documentation, visit its <p>For the complete hardened_malloc documentation, visit its
<a href="https://github.com/GrapheneOS/hardened_malloc">official documentation</a>.</p> <a href="https://github.com/GrapheneOS/hardened_malloc#hardened_malloc">official documentation</a>.</p>
<p>This documentation is also available in portable AsciiDoc format in my <p>This documentation is also available in portable AsciiDoc format in my
<a href="https://src.inferencium.net/Inferencium/doc/src/branch/stable/security/hardened_malloc.adoc">documentation source code repository</a>. <a href="https://src.inferencium.net/Inferencium/doc/src/branch/stable/security/hardened_malloc.adoc">documentation source code repository</a>.
</section> </section>
@ -57,8 +58,9 @@
</section> </section>
<section id="memory_pages"> <section id="memory_pages">
<h2 id="memory_pages"><a href="#memory_pages">Increase Permitted Amount of Memory Pages</a></h2> <h2 id="memory_pages"><a href="#memory_pages">Increase Permitted Amount of Memory Pages</a></h2>
<p>Add <code>vm.max_map_count = 1048576</code> to <code>/etc/sysctl.conf</code> <p>Add <code>vm.max_map_count = 1048576</code> to
to accommodate hardened_malloc’s large amount of guard pages.</p> <code>/etc/sysctl.conf</code> to accommodate hardened_malloc's large
amount of guard pages.</p>
</section> </section>
<section id="clone_source_code"> <section id="clone_source_code">
<h2 id="clone_source_code"><a href="#clone_source_code">Clone hardened_malloc Source Code</a></h2> <h2 id="clone_source_code"><a href="#clone_source_code">Clone hardened_malloc Source Code</a></h2>
@ -70,39 +72,48 @@
</section> </section>
<section id="compile"> <section id="compile">
<h2 id="compile"><a href="#compile">Compile hardened_malloc</a></h2> <h2 id="compile"><a href="#compile">Compile hardened_malloc</a></h2>
<p><p><code>$ make &lt;arguments&gt;</code></p> <p><p><code>$ make <var>&lt;arguments&gt;</var></code></p>
<p><code>CONFIG_N_ARENA=<var>n</var></code> can be adjusted to increase parallel <p><code>CONFIG_N_ARENA=<var>n</var></code> can be adjusted to increase
performance at the expense of memory usage, or decrease memory usage at the parallel performance at the expense of memory usage, or decrease memory
expense of parallel performance, where <var>n</var> is an integer. Higher values usage at the expense of parallel performance, where <var>n</var> is an
prefer parallel performance, lower values prefer lower memory usage. The number integer. Higher values prefer parallel performance, lower values prefer
of arenas has no impact on the security properties of hardened_malloc. lower memory usage. The number of arenas has no impact on the security
properties of hardened_malloc.
<ul> <ul>
<li>Minimum number of arenas: 1</li> <li>Minimum number of arenas: 1</li>
<li>Maximum number of arenas: 256</li> <li>Maximum number of arenas: 256</li>
</ul> </ul>
<p>For extra security, <code>CONFIG_SEAL_METADATA=true</code> can be used in <p>For extra security, <code>CONFIG_SEAL_METADATA=true</code> can be
order to control whether Memory Protection Keys are used to disable access to used in order to control whether Memory Protection Keys are used to
all writable allocator state outside of the memory allocator code. It’s disable access to all writable allocator state outside of the memory
currently disabled by default due to a significant performance cost for this use allocator code. It's currently disabled by default due to a significant
case on current generation hardware. Whether or not this feature is enabled, the performance cost for this use case on current generation hardware.
metadata is all contained within an isolated memory region with high entropy Whether or not this feature is enabled, the metadata is all contained
random guard regions around it.</p> within an isolated memory region with high entropy random guard regions
<p>For low-memory systems, <code>VARIANT=light</code> can be used to compile the around it.</p>
light variant of hardened_malloc, which sacrifices some security for much less <p>For low-memory systems, <code>VARIANT=light</code> can be used to
memory usage.</p> compile the light variant of hardened_malloc, which sacrifices some
security for much less memory usage.</p>
<p>For all compile-time options, see the <p>For all compile-time options, see the
<a href="https://github.com/GrapheneOS/hardened_malloc#configuration">configuration section</a> <a href="https://github.com/GrapheneOS/hardened_malloc#configuration">configuration section</a>
of hardened_malloc’s extensive official documentation.</p> of hardened_malloc's extensive official documentation.</p>
</section> </section>
<section id="copy_library"> <section id="copy_library">
<h2 id="copy_library"><a href="#copy_library">Copy Compiled hardened_malloc Library</a></h2> <h2 id="copy_library"><a href="#copy_library">Copy Compiled hardened_malloc Library</a></h2>
<p><code># cp out/libhardened_malloc.so &lt;target path&gt;</code></p> <p><code># cp out/libhardened_malloc.so <var>&lt;target path&gt;</var></code></p>
</section> </section>
<section id="preload_on_boot"> <section id="preload_on_boot">
<h2 id="preload_on_boot"><a href="#preload_on_boot">Set System to Preload hardened_malloc on Boot</a></h2> <h2 id="preload_on_boot"><a href="#preload_on_boot">Set System to Preload hardened_malloc on Boot</a></h2>
<p>musl-based systems: Add <code>export LD_PRELOAD="&lt;hardened_malloc path&gt;"</code> <p>
to <code>/etc/environment</code><br> <ul>
glibc-based systems: Add <code>&lt;hardened_malloc path&gt;</code> to <code>/etc/ld.so.preload</code></p> <li>musl-based systems: Add
<code>export LD_PRELOAD="<var>&lt;hardened_malloc path&gt;</var>"</code>
to <code>/etc/environment</code></li>
<li>glibc-based systems:
Add <code><var>&lt;hardened_malloc path&gt;</var></code> to
<code>/etc/ld.so.preload</code></li>
</ul>
</p>
</section> </section>
</body> </body>
</html> </html>