12

I often read that features such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) are provided on Windows. On Windows, you are given some control over turning on DEP for 32-bit programs.

  • Are these features available in Ubuntu
  • is there anything we need to do to turn these features on?
Improve this question

3 Answers 3

Reset to default
20

Yes for both. They are on by default; you don't need to do anything to enable it. Longer answer follows...

DEP is used by default in Ubuntu. This is done via the NX bit if the CPU supports it, or emulated via memory segmentation if the CPU does not support it. For more details, see the non-executable memory feature item.

ASLR is used by default in Ubuntu on any memory segments that can be relocated (stack, libraries, heap, mmap). The only portion of a program that is not relocatable by default is the main code area ("text" segment). Programs need to be specially compiled as PIE (position independent executable) to enable this. Many sensitive programs are already built this way. For more details, see the list

Many additional security features are also available by default in Ubuntu. See the Ubuntu Security Features documentation for the full list.

Improve this answer
0
1

The Linux kernel, by default, does make use of similar technologies, however they are different from the Windows versions. If your processor has the capability to set the NX bit (most modern CPUs), then the kernel will make use of it. There is also a weak implementation in ASLR in the kernel, and stronger ones can be installed, but are not installed by default on Ubuntu.

Improve this answer
2
  • 3
    I can't find references at the moment (the Wikipedia article en.wikipedia.org/wiki/ASLR doesn't have the bits of entropy comparison), but my understanding is that Windows ASLR is weaker than Linux. And if you want heavier-duty ASLR than the Linux default, you can build your own kernel the PaX patchset, which offers higher entropy at a small compatibility cost.
    – Kees Cook
    Mar 28, 2011 at 21:27
  • A good article breaking down the differences cert.org/blogs/certcc/post.cfm?EntryID=191 of course, that wouldn't be complete with some debating of the finer details :D reddit.com/r/netsec/comments/1xjwde/…
    – Univ426
    Apr 12, 2014 at 21:00
0

Generally and simply speaking, you would need a PAE version of the kernel for this. For detailed information on this topic see this summary.

Improve this answer
4
  • 3
    PAE is only needed for hardware NX. 64bit is already PAE, so on 32bit if you aren't running a PAE kernel, or your hardware lacks the NX bit, Ubuntu emulates the NX feature using memory segmentation.
    – Kees Cook
    Mar 28, 2011 at 21:22
  • @Kees Cook: Thanks for the info. OP asked about the 32bit. On my system (ubuntu 10.10 32bit) dmesg says NX (Execute Disable) protection cannot be enabled: non-PAE kernel. On the other hand, when I ran tests from bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/… , nx seemed to be enforced, but not for the -pie and -rie tests. So it's a little confusing for me.
    – arrange
    Mar 29, 2011 at 7:54
  • 2
    unfortunately, 10.10 and later's dmesg report has a bug where it doesn't say when NX emulation is enabled on hardware with NX but without a PAE kernel: kernel.ubuntu.com/git?p=ubuntu/…
    – Kees Cook
    Mar 29, 2011 at 18:29
  • 1
    (This has been reported as a bug now: bugs.launchpad.net/ubuntu/+source/linux/+bug/745181)
    – Kees Cook
    Mar 29, 2011 at 18:56

You must log in to answer this question.