<div class="gmail_quote">On Thu, Jul 9, 2009 at 5:59 PM, Till Maas <<a href="mailto:opensource@till.name">opensource@till.name</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div class="im">On Thu July 9 2009, yersinia wrote: > But something one have to pay a security prize on not disabling it : it > render impossible to have a > centralizzated security integrity management (e.g. <a href="http://rfc.sf.net" target="_blank">rfc.sf.net</a> for example) > or one have to skip from check the prelink binary. Very bad i think. </div>You pay a security prize if you disable prelink, because it also performs address space randomization: <a href="http://lwn.net/Articles/190139/" target="_blank">http://lwn.net/Articles/190139/</a> </blockquote><div> Strange enough this authorative refs, imho, not cited prelink as a security feature for aslr :=) <a href="http://www.awe.com/mark/blog/200801070918.html" target="_blank">http://www.awe.com/mark/blog/200801070918.html</a> Btw, the reality is more complex this days. Details omitted, this is not a security mailing list. Regards </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Btw. you can also patch the remote integrity checker to use prelink to either get a checksum of the perlinked binary or undo the prelinking before checking it. Regards Till -- fedora-devel-list mailing list <a href="mailto:fedora-devel-list@redhat.com">fedora-devel-list@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/fedora-devel-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-devel-list</a> </blockquote></div>