Actions

Hardened Malloc Kicksecure

From Whonix



Kicksecurehardenedmalloc.jpg

Hardened Malloc | Hardened Malloc Kicksecure Fork

Introduction[edit]

Hardened Malloc is a hardened memory allocator which can be used with many applications to increase security.

According to the author's GitHub description: [1]

This is a security-focused general purpose memory allocator providing the malloc API along with various extensions. It provides substantial hardening against heap corruption vulnerabilities. The security-focused design also leads to much less metadata overhead and memory waste from fragmentation than a more traditional allocator design. It aims to provide decent overall performance with a focus on long-term performance and memory usage rather than allocator micro-benchmarks. It offers scalability via a configurable number of entirely independently arenas, with the internal locking within arenas further divided up per size class.

Original [archive] Hardened Malloc unfortunately cannot be globally enabled by default in Whonix ™ and Kicksecure ™ due to issues [archive].

The development goal of Hardened Malloc Kicksecure is pre-installation by default in Whonix ™ and Kicksecure ™.

Hardened Malloc Kicksecure uses different compile time options.

Both, Hardened Malloc and Hardened Malloc Kicksecure are already installed by default in Whonix ™ and Kicksecure ™ but not yet enabled by default.

Hardened Malloc Kicksecure is not yet enabled by default since there are still various known issues. Most notably, it breaks the OpenSSH server sshd on Debian buster based operating systems, which will hopefully be fixed in Debian bullseye and above and possibly VirtualBox host software crashes [archive], which haven't been reproduced by testers yet.

Advanced users may still wish to use Hardened Malloc for specific high risk applications.

Before getting started with Hardened Malloc (Kicksecure) it is recommended to first test the host operating system using memtest86+ (link) since hardware issues with RAM might be more likely be resulting in system crashes with Hardened Malloc (Kicksecure) enabled. [2]

Forum development discussion:
https://forums.whonix.org/t/hardened-malloc-hardened-memory-allocator/7474/69 [archive]

Enable[edit]

Testers only! Testers only!

Package hardened-malloc-kicksecure-enable [3] is provided as an easy way to enable Hardened Malloc Kicksecure globally.

Install hardened-malloc-kicksecure-enable.

1. Update the package lists.

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

3. Install the hardened-malloc-kicksecure-enable package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends hardened-malloc-kicksecure-enable

The procedure of installing hardened-malloc-kicksecure-enable is complete.

Disable[edit]

hardened-malloc-kicksecure can be disabled either per application or globally.

Disable per Application[edit]

Apply the following steps to disable hardened-malloc-kicksecure per application.

Prepend the ld-system-preload-disable [archive] wrapper.

Syntax:

ld-system-preload-disable application

Example:

Note: replace chromium with the actual application which should be started without ld system preload.

ld-system-preload-disable chromium

Disable Globally[edit]

Apply the following steps to globally disable hardened-malloc-kicksecure.

If the system is still fully functional, the easiest way is to uninstall the hardened-malloc-kicksecure-enable package.

sudo apt purge hardened-malloc-kicksecure-enable

Otherwise...

1) Boot into recovery mode. Optional.

This is only required if the system is no longer bootable. In this case, refer to boot into recovery mode.

2) View the /etc/ld.so.preload file.

cat /etc/ld.so.preload

3) Remove /usr/lib/libhardened_malloc.so/libhardened_malloc_kicksecure.so from /etc/ld.so.preload.

If not using /etc/ld.so.preload for anything else. Warning: this removes all entries from /etc/ld.so.preload.

sudo rm /etc/ld.so.preload

Issues[edit]

workaround available[edit]

slowdown by swap-file-creator shutdown

chromium requires ld-system-preload-disable

  • https://bugs.debian.org/971876 [archive]
    • workaround ld-system-preload-disable chromium ok
    • chromium from flathub also functional (hardened-malloc-kicksecure probably disregarded inside flatpak's bubblewrap based sandbox?)

no workaround available[edit]

breaks OpenSSH server sshd in Debian buster

cryptsetup slowdown by factor ~ 6

could break scripts / build process

  • TODO: test building Whonix with hardened-malloc-kicksecure enabled

chromium crashes with hardened-malloc(-kicksecure) (requires disabling using ld-system-preload-disable)

does it break https://packages.debian.org/buster/gsmartcontrol [archive]?

VirtualBox crashes with hardened memory allocator Hardened Malloc on the host [archive] [4]

Notes[edit]

Credits and Source Code[edit]

The original [archive] source software is maintained by security researcher, Daniel Micay.

This website [archive] is the software fork [archive] homepage for Hardened Malloc Kicksecure, with a focus on pre-installation by default in Whonix ™ and Kicksecure ™. The software fork source code can be found here [archive]. Continuous integration: travis CI [archive]

Footnotes[edit]

  1. https://github.com/GrapheneOS/hardened_malloc [archive]
  2. In the experience of Whonix ™ developer Patrick, the VirtualBox host software crashed with Hardened Malloc enabled with different error messages when faulty RAM banks where used compared to VirtualBox host software crashes with RAM banks that did not show any errors in memtest86+.
  3. https://gitlab.com/whonix/hardened_malloc/-/blob/master/debian/control#L42 [archive]


text=Jobs in USA
Jobs in USA


Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png link=mailto:?subject=Hardened Malloc Kicksecure&body=https://www.whonix.org/wiki/Hardened_Malloc_Kicksecure link=https://reddit.com/submit?url=https://www.whonix.org/wiki/Hardened_Malloc_Kicksecure&title=Hardened Malloc Kicksecure link=https://news.ycombinator.com/submitlink?u=https://www.whonix.org/wiki/Hardened_Malloc_Kicksecure&t=Hardened Malloc Kicksecure link=https://mastodon.technology/share?message=Hardened Malloc Kicksecure%20https://www.whonix.org/wiki/Hardened_Malloc_Kicksecure&t=Hardened Malloc Kicksecure

Iconfinder Apple Mail 2697658.png Subscribe to Whonix ™ Newsletter.

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.