
ç»åïŒã€ã³ã¿ãŒãããã¢ãŒã«ã€ãããã¯ã®ç»åãOpensource.comã«ãã£ãŠå€æŽãããŸãããCC BY-SA 4.0
åããœãŒã¹ã³ãŒããã³ã³ãã€ã«ããåŸãç°ãªããã€ããªã«ãªã£ãŠããŸãå¯èœæ§ããããŸããããã¯ãã³ã³ãã€ã©ãŒã®æã«æž¡ããã©ã°ã«ãã£ãŠç°ãªããŸãããããã®ãã©ã°ã®äžéšã䜿çšãããšããã€ããªã®ã»ãã¥ãªãã£é¢é£ã®ããããã£ã®æ°ãæå¹ãŸãã¯ç¡å¹ã«ã§ããŸãã
ãããã®ããã€ãã¯ãããã©ã«ãã§ã³ã³ãã€ã©ãŒã«ãã£ãŠæå¹ãŸãã¯ç¡å¹ã«ãããŸããããããç§ãã¡ãæ°ä»ããŠããªããã€ããªãã¡ã€ã«ã«è匱æ§ãçºçããå¯èœæ§ãããæ¹æ³ã§ãã
Checksecã¯ãã³ã³ãã€ã«æã«å«ãŸããŠããããããã£ãå€å¥ããããã®åçŽãªãŠãŒãã£ãªãã£ã§ãããã®èšäºã§ç§ã¯ããªãã«èšãã§ãããïŒ
- checksecãŠãŒãã£ãªãã£ã䜿çšããŠè匱æ§ãèŠã€ããæ¹æ³ã
- èŠã€ãã£ãè匱æ§ãä¿®æ£ããããã«gccã³ã³ãã€ã©ã䜿çšããæ¹æ³ã
checksecã®ã€ã³ã¹ããŒã«
Fedora OSããã³ãã®ä»ã®RPMããŒã¹ã®ã·ã¹ãã ã®å ŽåïŒ
$ sudo dnf install checksec
DebianããŒã¹ã®ã·ã¹ãã ã®å Žåã¯aptã䜿çšããŸãã
checksecã«ããã¯ã€ãã¯ã¹ã¿ãŒã
checksecãŠãŒãã£ãªãã£ã¯ãåäžã®ã¹ã¯ãªãããã¡ã€ã«ã§æ§æãããŠããŸãããããã¯éåžžã«å€§ãããªããŸãããã®ééæ§ã®ãããã§ããã€ããªã®è匱æ§ãæ€çŽ¢ããããã®ã©ã®ã·ã¹ãã ã³ãã³ããå éšã§å®è¡ãããŠããããç¥ãããšãã§ããŸãã
$ file /usr/bin/checksec /usr/bin/checksec: Bourne-Again shell script, ASCII text executable, with very long lines $ wc -l /usr/bin/checksec 2111 /usr/bin/checksec
ãã£ã¬ã¯ããªãã©ãŠãžã³ã°ãŠãŒãã£ãªãã£ïŒlsïŒã§checksecãå®è¡ããŠã¿ãŸãããã
$ checksec --file=/usr/bin/ls <strong>RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE</strong> Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols Yes 5 17 /usr/bin/ls
ã¿ãŒããã«ã§ã³ãã³ããå®è¡ãããšããã®ãã€ããªãæã€æçšãªããããã£ãšæããªãããããã£ã«é¢ããã¬ããŒããåãåããŸãã
æåã®è¡ã¯ããŒãã«ã®å é ã§ãRELROãSTACK CANARYãNXãªã©ã®ããŸããŸãªã»ãã¥ãªãã£ããããã£ãäžèŠ§è¡šç€ºãããŸãã2è¡ç®ã¯ãlsãŠãŒãã£ãªãã£ãã€ããªã®ãããã®ããããã£ã®å€ã瀺ããŠããŸãã
ããã«ã¡ã¯ãã€ããªïŒ
æãåçŽãªCã³ãŒããããã€ããªãã³ã³ãã€ã«ããŸãã
#include <stdio.h>
int main()
{
printf(«Hello World\n»);
return 0;
}
ãããŸã§ã®ãšããã-oãé€ããŠãã³ã³ãã€ã©ã«åäžã®ãã©ã°ãæž¡ããŠããªãããšã«æ³šæããŠãã ããïŒããã¯èŠç¹ã®æšªã«ãããŸãããã³ã³ãã€ã«çµæãåºåããå Žæã瀺ããŠããã ãã§ãïŒã
$ gcc hello.c -o hello
$ file hello
hello: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=014b8966ba43e3ae47fab5acae051e208ec9074c, for GNU/Linux 3.2.0, not stripped
$ ./hello
Hello World
次ã«ããã€ããªã«å¯ŸããŠchecksecãŠãŒãã£ãªãã£ãå®è¡ããŸããäžéšã®ããããã£ã¯ããããã£ãšã¯ç°ãªããŸã
ls ( ): $ checksec --file=./hello <strong>RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE</strong> Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH 85) Symbols No 0 0./hello
Checksecã䜿çšãããšãããŸããŸãªåºå圢åŒã䜿çšã§ããŸããããã¯ã-outputãªãã·ã§ã³ã§æå®ã§ããŸããJSON圢åŒãéžæããjqãŠãŒãã£ãªãã£ã䜿çšããŠåºåãããããããããããŸã ã
$ checksec --file=./hello --output=json | jq { «./hello»: { «relro»: «partial», «canary»: «no», «nx»: «yes», «pie»: «no», «rpath»: «no», «runpath»: «no», «symbols»: «yes», «fortify_source»: «no», «fortified»: «0», «fortify-able»: «0» } }
è匱æ§ã®åæïŒchecksecïŒãšæé€ïŒgccïŒ
äžã§äœæããããã€ããªãã¡ã€ã«ã«ã¯ãããšãã°ããã®è匱æ§ã®çšåºŠã決å®ããããã€ãã®ããããã£ããããŸãããã®ãã¡ã€ã«ã®ããããã£ãlsãã€ããªïŒäžèšã«ããªã¹ããããŠããŸãïŒã®ããããã£ãšæ¯èŒããchecksecãŠãŒãã£ãªãã£ã䜿çšããŠãããè¡ãæ¹æ³ã説æããŸãã
ããã«ãã¢ã€ãã ããšã«ãèŠã€ãã£ãè匱æ§ãæé€ããæ¹æ³ã瀺ããŸãã
1.ãããã°ã·ã³ãã«
ç°¡åã«å§ããŸããããç¹å®ã®ã·ã³ãã«ã¯ãã³ã³ãã€ã«æã«ãã€ããªã«å«ãŸããŸãããããã®ã·ã³ãã«ã¯ãœãããŠã§ã¢éçºã§äœ¿çšãããŸãããããã°ãšãã°ä¿®æ£ã«å¿ èŠã§ãã
ãããã°ã·ã³ãã«ã¯éåžžãéçºè ãäžè¬çãªäœ¿çšã®ããã«ãªãªãŒã¹ãããã€ããªã®ããŒãžã§ã³ããåé€ãããŸããããã¯ãããã°ã©ã ã®åäœã«ã¯ãŸã£ãã圱é¿ããŸããããã®ã¯ãªãŒã³ã¢ããïŒåèªã¹ããªããã§ç€ºããã ïŒã¯ãæåãåé€ãããåŸã«ãã¡ã€ã«ã軜ããªããããã¹ããŒã¹ãç¯çŽããããã«è¡ãããããšããããããŸãããŸãããããã©ã€ãšã¿ãªãœãããŠã§ã¢ã§ã¯ãæ»æè ããã€ããªåœ¢åŒã§æåãèªã¿åã£ãŠç¬èªã®ç®çã«äœ¿çšã§ããããããããã®æåã¯åé€ãããããšããããããŸãã
Checksecã¯ããããã°ã·ã³ãã«ããã€ããªã«ååšããããšã瀺ããŠããŸãããlsãã¡ã€ã«ã«ã¯ååšããŸããã
$ checksec --file=/bin/ls --output=json | jq | grep symbols «symbols»: «no», $ checksec --file=./hello --output=json | jq | grep symbols «symbols»: «yes»,
fileã³ãã³ããå®è¡ãããšãåãããšã衚瀺ãããŸããæåã¯åé€ãããŸããã
$ file hello
hello: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=014b8966ba43e3ae47fab5acae051e208ec9074c, for GNU/Linux 3.2.0, <strong>not stripped</strong>
checksecã®ããã¿
--debugãªãã·ã§ã³ãæå®ããŠãã®ã³ãã³ããå®è¡ããŠã¿ãŸãããã
$ checksec --debug --file=./hello
checksecãŠãŒãã£ãªãã£ã¯1ã€ã®é·ãã¹ã¯ãªããã§ãããããBash颿°ã䜿çšããŠèª¿ã¹ãããšãã§ããŸããã¹ã¯ãªãããhelloãã¡ã€ã«ã«å¯ŸããŠå®è¡ããã³ãã³ãã衚瀺ããŠã¿ãŸãããã
$ bash -x /usr/bin/checksec --file=./hello
echo_messageã«ç¹ã«æ³šæããŠãã ãã-ãã€ããªã«ãããã°ã·ã³ãã«ãå«ãŸããŠãããã©ããã«é¢ããã¡ãã»ãŒãžã®åºåïŒ
+ readelf -W --symbols ./hello
+ grep -q '\.symtab'
+ echo_message '\033[31m96) Symbols\t\033[m ' Symbols, ' symbols=«yes»' '«symbols»:«yes»,'
checksecãŠãŒãã£ãªãã£ã¯ãç¹å¥ãªãã©ã°--symbolsãæå®ããreadelfã³ãã³ãã䜿çšããŠããã€ããªãã¡ã€ã«ãèªã¿åããŸãããã€ããªå ã®ãã¹ãŠã®ãããã°ã·ã³ãã«ãåºåããŸãã
$ readelf -W --symbols ./hello
.symtabã»ã¯ã·ã§ã³ã®å 容ãããèŠã€ãã£ãã·ã³ãã«ã®æ°ã確èªã§ããŸãã
$ readelf -W --symbols ./hello | grep -i symtab
ã³ã³ãã€ã«åŸã«ãããã°ã·ã³ãã«ãåé€ããæ¹æ³
ã¹ããªãããŠãŒãã£ãªãã£ã¯ãããæ¯æŽããŸãã
$ gcc hello.c -o hello
$
$ file hello
hello: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=322037496cf6a2029dcdcf68649a4ebc63780138, for GNU/Linux 3.2.0, <strong>not stripped</strong>
$
$ strip hello
$
$ file hello
hello: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=322037496cf6a2029dcdcf68649a4ebc63780138, for GNU/Linux 3.2.0, <strong>stripped</strong>
ã³ã³ãã€ã«æã«ãããã°ã·ã³ãã«ãåé€ããæ¹æ³
ã³ã³ãã€ã«ãããšãã¯ã-sãã©ã°ã䜿çšããŸãã
$ gcc -s hello.c -o hello
$
$ file hello
hello: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=247de82a8ad84e7d8f20751ce79ea9e0cf4bd263, for GNU/Linux 3.2.0, <strong>stripped</strong>
checksecãŠãŒãã£ãªãã£ã䜿çšããŠãã·ã³ãã«ãåé€ãããããšã確èªããããšãã§ããŸãã
$ checksec --file=./hello --output=json | jq | grep symbols «symbols»: «no»,
2.ã«ããªã¢
ã«ããªã¢ïŒæ å ±æäŸè ïŒã¯ããããã¡ãŒãšå¶åŸ¡ããŒã¿ã®éã®ã¹ã¿ãã¯ã«æ ŒçŽããããç§å¯ã®ãå€ã§ãããããã¯ããããã¡ãªãŒããŒãããŒæ»æããä¿è·ããããã«äœ¿çšãããŸãïŒãããã®å€ã倿Žãããå Žåã¯ãã¢ã©ãŒã ã鳎ãã䟡å€ããããŸããã¢ããªã±ãŒã·ã§ã³ãèµ·åããããšããã®ã¢ããªã±ãŒã·ã§ã³çšã«ç¬èªã®ã¹ã¿ãã¯ãäœæãããŸãããã®å Žåãããã¯ããã·ã¥æäœãšãããæäœãåããåãªãããŒã¿æ§é ã§ããæ»æè ã¯æªæã®ããããŒã¿ãæºåããŠã¹ã¿ãã¯ã«æžã蟌ãå¯èœæ§ããããŸãããã®å Žåããããã¡ããªãŒããŒãããŒããã¹ã¿ãã¯ãæå·ããå¯èœæ§ããããŸããå°æ¥çã«ã¯ãããã¯ããã°ã©ã ã®ã¯ã©ãã·ã¥ã«ã€ãªããã§ããããã«ããªã¢å€ã®åæã«ããããããã³ã°ãçºçããããšããã°ããçè§£ããŠã¢ã¯ã·ã§ã³ãå®è¡ã§ããŸãã
$ checksec --file=/bin/ls --output=json | jq | grep canary
«canary»: «yes»,
$
$ checksec --file=./hello --output=json | jq | grep canary
«canary»: «no»,
$
, canary, checksec :
$ readelf -W -s ./hello | grep -E '__stack_chk_fail|__intel_security_cookie'
ã«ããªã¢ããªã³ã«ãã
ãããè¡ãã«ã¯ãã³ã³ãã€ã«æã«-stack-protector-allãã©ã°ã䜿çšããŸãã
$ gcc -fstack-protector-all hello.c -o hello $ checksec --file=./hello --output=json | jq | grep canary «canary»: «yes»,
ããã§ãchecksecã¯ãã«ããªã¢ã¡ã«ããºã ããªã³ã«ãªã£ãŠããããšãæç¢ºãªè¯å¿ã§æããŠãããŸãã
$ readelf -W -s ./hello | grep -E '__stack_chk_fail|__intel_security_cookie'
2: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __stack_chk_fail@GLIBC_2.4 (3)
83: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __stack_chk_fail@@GLIBC_2.4
$
3.PIE
æå¹ãªPIEããããã£ã䜿çšãããšã絶察ã¢ãã¬ã¹ã«é¢ä¿ãªããå®è¡å¯èœã³ãŒããã¡ã¢ãªã«ä»»æã«é 眮ã§ããŸã
ãPIEïŒPosition Independent ExecutableïŒ-äœçœ®ã«äŸåããªãå®è¡å¯èœã³ãŒããããã»ã¹ã®ã¢ãã¬ã¹ç©ºéã®ã©ãã«ã©ã®é åã®ã¡ã¢ãªãããããäºæž¬ããæ©èœã¯ãæ»æè ã®æã«æž¡ããŸãããŠãŒã¶ãŒããã°ã©ã ã¯ãPIEãªãã·ã§ã³ã§ã³ã³ãã€ã«ãããŠããªãéããäºåå®çŸ©ãããããã»ã¹ä»®æ³ã¡ã¢ãªã¢ãã¬ã¹ããããŒãããã³å®è¡ãããŸãã PIEã䜿çšãããšããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã¯å®è¡å¯èœã³ãŒãã®ã»ã¯ã·ã§ã³ãã¡ã¢ãªã®ä»»æã®ãã£ã³ã¯ã«ããŒãã§ãããããè§£èªãã¯ããã«å°é£ã«ãªããŸãã
$ checksec --file=/bin/ls --output=json | jq | grep pie «pie»: «yes», $ checksec --file=./hello --output=json | jq | grep pie «pie»: «no»,
å€ãã®å ŽåãPIEããããã£ã¯ãã©ã€ãã©ãªãã³ã³ãã€ã«ãããšãã«ã®ã¿å«ãŸããŸãã以äžã®åºåã§ã¯ãhelloã¯LSBå®è¡å¯èœãã¡ã€ã«ãšããŠããŒã¯ãããæšæºã©ã€ãã©ãªlibcïŒ.soïŒãã¡ã€ã«ã¯LSBå ±æãªããžã§ã¯ããšããŠããŒã¯ãããŠããŸãã
$ file hello
hello: ELF 64-bit <strong>LSB executable</strong>, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=014b8966ba43e3ae47fab5acae051e208ec9074c, for GNU/Linux 3.2.0, not stripped
$ file /lib64/libc-2.32.so
/lib64/libc-2.32.so: ELF 64-bit <strong>LSB shared object</strong>, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4a7fb374097fb927fb93d35ef98ba89262d0c4a4, for GNU/Linux 3.2.0, not stripped
Checksecã¯ã次ã®ããã«ãã®æ å ±ãååŸããŸãã
$ readelf -W -h ./hello | grep EXEC Type: EXEC (Executable file)
ã©ã€ãã©ãªã«å¯ŸããŠåãã³ãã³ããå®è¡ãããšãEXECã®ä»£ããã«DYNã衚瀺ãããŸãã
$ readelf -W -h /lib64/libc-2.32.so | grep DYN Type: DYN (Shared object file)
PIEããªã³ã«ããŸã
ããã°ã©ã ãã³ã³ãã€ã«ãããšãã¯ã次ã®ãã©ã°ãæå®ããå¿ èŠããããŸãã
$ gcc -pie -fpie hello.c -o hello
PIEããããã£ãæå¹ã«ãªã£ãŠããããšã確èªããã«ã¯ã次ã®ã³ãã³ããå®è¡ããŸãã
$ checksec --file=./hello --output=json | jq | grep pie «pie»: «yes», $
ããã§ããã€ããªãã¡ã€ã«ïŒhelloïŒã®ã¿ã€ããEXECããDYNã«å€æŽãããŸãã
$ file hello
hello: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=bb039adf2530d97e02f534a94f0f668cd540f940, for GNU/Linux 3.2.0, not stripped
$ readelf -W -h ./hello | grep DYN
Type: DYN (Shared object file)
4.NX
ãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãšããã»ããµããŒã«ã䜿çšãããšãä»®æ³ã¡ã¢ãªããŒãžãžã®ã¢ã¯ã»ã¹æš©ãæè»ã«æ§æã§ããŸããNXïŒNo ExecuteïŒããããã£ãæå¹ã«ããããšã§ãããŒã¿ãããã»ããµåœä»€ãšããŠè§£éãããã®ãé²ãããšãã§ããŸããå€ãã®å Žåããããã¡ãªãŒããŒãããŒæ»æã§ã¯ãæ»æè ã¯ã³ãŒããã¹ã¿ãã¯ã«ããã·ã¥ããŠããå®è¡ããããšããŸãããã ãããããã®ã¡ã¢ãªã»ã°ã¡ã³ãã§ã³ãŒããå®è¡ãããªãããã«ããããšã§ããã®ãããªæ»æãé²ãããšãã§ããŸããgccã䜿çšããéåžžã®ã³ã³ãã€ã«ã§ã¯ããã®ããããã£ã¯ããã©ã«ãã§æå¹ã«ãªã£ãŠããŸãã
$ checksec --file=/bin/ls --output=json | jq | grep nx «nx»: «yes», $ checksec --file=./hello --output=json | jq | grep nx «nx»: «yes»,
Checksecã¯ãå床readelfã³ãã³ãã䜿çšããŠãNXããããã£ã«é¢ããæ å ±ãååŸããŸãããã®å ŽåãRWã¯ã¹ã¿ãã¯ãèªã¿åã/æžã蟌ã¿ã§ããããšãæå³ããŸãããã ãããã®çµã¿åããã«ã¯Eæåãå«ãŸããŠããªãããããã®ã¹ã¿ãã¯ããã³ãŒããå®è¡ããããšã¯çŠæ¢ãããŠããŸãã
$ readelf -W -l ./hello | grep GNU_STACK GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RW 0x10
NXãç¡å¹ã«ãã
NXããããã£ãç¡å¹ã«ããããšã¯ãå§ãããŸããããæ¬¡ã®ããã«è¡ãããšãã§ããŸãã
$ gcc -z execstack hello.c -o hello $ checksec --file=./hello --output=json | jq | grep nx «nx»: «no»,
ã³ã³ãã€ã«åŸãã¹ã¿ãã¯ã®ã¢ã¯ã»ã¹èš±å¯ãRWEã«å€æŽãããããšãããããŸãã
$ readelf -W -l ./hello | grep GNU_STACK GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RWE 0x10
5. RELRO
åçã«ãªã³ã¯ããããã€ããªã§ã¯ãç¹å¥ãªGOTïŒã°ããŒãã«ãªãã»ããããŒãã«ïŒã䜿çšããŠãã©ã€ãã©ãªãã颿°ãåŒã³åºããŸãããã®ããŒãã«ã¯ãELFïŒExecutable Linkable FormatïŒãã€ããªã«ãã£ãŠåç §ãããŸããRELROïŒRelocation Read-OnlyïŒä¿è·ãæå¹ã«ãªã£ãŠããå ŽåãGOTã¯èªã¿åãå°çšã«ãªããŸããããã«ãããããŒãã«ã¬ã³ãŒãã倿Žããããã€ãã®ã¿ã€ãã®æ»æããä¿è·ã§ããŸãã
$ checksec --file=/bin/ls --output=json | jq | grep relro «relro»: «full», $ checksec --file=./hello --output=json | jq | grep relro «relro»: «partial»,
ãã®å ŽåãRELROããããã£ã®1ã€ã ããæå¹ã«ãªã£ãŠãããããchecksecã¯å€ãpartialããåºåããŸããChecksecã¯ãreadelfã³ãã³ãã䜿çšããŠèšå®ã衚瀺ããŸãã
$ readelf -W -l ./hello | grep GNU_RELRO GNU_RELRO 0x002e10 0x0000000000403e10 0x0000000000403e10 0x0001f0 0x0001f0 R 0x1 $ readelf -W -d ./hello | grep BIND_NOW
ãã«ãããã¯ã·ã§ã³ããªã³ã«ããïŒFULL RELROïŒ
ãããè¡ãã«ã¯ãã³ã³ãã€ã«æã«é©åãªãã©ã°ã䜿çšããå¿ èŠããããŸãã
$ gcc -Wl,-z,relro,-z,now hello.c -o hello $ checksec --file=./hello --output=json | jq | grep relro «relro»: «full»,
ããã§ããã€ããªã¯FULLRELROã®åèªç§°å·ãååŸããŸããã
$ readelf -W -l ./hello | grep GNU_RELRO GNU_RELRO 0x002dd0 0x0000000000403dd0 0x0000000000403dd0 0x000230 0x000230 R 0x1 $ readelf -W -d ./hello | grep BIND_NOW 0x0000000000000018 (BIND_NOW)
ãã®ä»ã®checksecæ©èœ
ã»ãã¥ãªãã£ã®ãããã¯ã¯ééãªãç ç©¶ããããšãã§ããŸãããã®èšäºã§ç°¡åãªchecksecãŠãŒãã£ãªãã£ã«ã€ããŠè©±ããŠããŠãããã¹ãŠãç¶²çŸ ããããšã¯ã§ããŸããããã ããããã«ããã€ãã®è峿·±ãå¯èœæ§ã«ã€ããŠèª¬æããŸãã
è€æ°ã®ãã¡ã€ã«ããã§ãã¯ãã
ãã¡ã€ã«ããšã«åå¥ã®ã³ãã³ããå®è¡ããå¿ èŠã¯ãããŸãããè€æ°ã®ãã€ããªã«å¯ŸããŠ1ã€ã®ã³ãã³ããäžåºŠã«å®è¡ã§ããŸãã
$ checksec --dir=/usr/bin
ããã»ã¹ã®ç¢ºèª
checksecãŠãŒãã£ãªãã£ã䜿çšãããšãããã»ã¹ã®ã»ãã¥ãªãã£ãåæããããšãã§ããŸããæ¬¡ã®ã³ãã³ãã¯ãã·ã¹ãã ã§å®è¡äžã®ãã¹ãŠã®ããã°ã©ã ã®ããããã£ã衚瀺ããŸãïŒãããè¡ãã«ã¯ã-proc-allãªãã·ã§ã³ã䜿çšããå¿ èŠããããŸãïŒã
$ checksec --proc-all
ååãæå®ããŠããã§ãã¯ããããã»ã¹ã1ã€éžæããããšãã§ããŸãã
$ checksec --proc=bash
ã«ãŒãã«ãã§ãã¯
åæ§ã«ãã·ã¹ãã ã®ã«ãŒãã«ã®è匱æ§ãåæã§ããŸãã
$ checksec --kernel
äºåã«èŠåãããŠããŸã
ã»ãã¥ãªãã£ããããã£ã詳现ã«èª¿æ»ãããããããæ£ç¢ºã«äœã«åœ±é¿ããã©ã®ãããªçš®é¡ã®æ»æãé²ãããšãã§ããããçè§£ããŠãã ãããããªããå©ããããã«ChecksecïŒ
Macleodã®ã¯ã©ãŠããµãŒã㌠ã¯é«éã§å®å šã§ãã
äžèšã®ãªã³ã¯ã䜿çšãããããããŒãã¯ãªãã¯ããŠç»é²ãããšãä»»æã®æ§æã®ãµãŒããŒãã¬ã³ã¿ã«ããæåã®æã10ïŒ å²åŒã«ãªããŸãã
