Subject: [alpine-devel] RFC: disable mprotect or JIT on web browsers

From: Natanael Copa <[email-masked]>
Date: Tue, 17 May 2011 11:25:39 +0200

Hi,

Modern browsers uses just-in-time (JIT) compilers to gain maximum
performance of the javascripts. This requires that the application can
allocate memory where it can both write to it and then execute it. This
is not allowed with our Grsecurity kernel for security reasons.

So currently, midori has mprotect disabled and it looks like we might
need to do the same with firefox. Alternatively we will need to patch
webkit and xulrunner to disable jit.

So this is a trade off.

I am slightly towards prioritize security. (I think fedora does so for
webkit too btw)

What do you prefer? JIT speed or MPROTECT security for our browsers?

-nc

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Jeremy Thomerson <[email-masked]>
Date: Tue, 17 May 2011 08:30:24 -0400

I don't have a lot of say here, but you asked for comments, so here's mine:

What's the advantage of turning Alpine into a full desktop environment with
Firefox, etc?  The tagline for Alpine is "A *security-oriented*, lightweight
Linux distribution ..."

I'd be concerned about going against that (disabling a security feature)
just to enable web browsing on a distro that is intended as a hardened
server distro.

Jeremy Thomerson

---

From: Nathan Angelacos <[email-masked]>
Date: Tue, 17 May 2011 07:38:18 -0700

On 05/17/2011 05:30 AM, Jeremy Thomerson wrote:
> What's the advantage of turning Alpine into a full desktop environment
> with Firefox, etc?  The tagline for Alpine is "A *security-oriented*,
> lightweight Linux distribution ..."

+1

> On Tue, May 17, 2011 at 5:25 AM, Natanael Copa <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     Hi,
>
>     <mailto:[email-masked]>
>     <mailto:[email-masked]>
>     ---
>
>

---

---

From: Natanael Copa <[email-masked]>
Date: Thu, 19 May 2011 15:53:13 +0200

On Tue, 17 May 2011 08:30:24 -0400
Jeremy Thomerson <[email-masked]> wrote:

> I'd be concerned about going against that (disabling a security
> feature) just to enable web browsing on a distro that is intended as
> a hardened server distro.

No. we will never disable a security feature in kernel for everyone due
to a web browser which only used by a few (crazy ppl).

What I'm talking about is disable the feature for the firefox and
midori binaries only. So only the browser itself would run with reduced
security (but with JIT enabled). Everything else would still have the
security feature. So this only affects people who actually use alpine
linux for web browsing.

But I'm still thinking we want accept a more secure but somewhat slower
browser than a faster browser bu somewhat less secure.

Thanks for your input.

-nc

---