This documentation contains instructions to use hardened_malloc - memory allocator as the system's default memory allocator. These instructions apply to both musl and - glibc C libraries on Unix-based and Unix-like systems.
+ memory allocator as the system's default memory allocator via dynamic linking as a shared library. These + instructions apply to both musl and glibc C libraries on Linux-based systems.hardened_malloc can also be used per-application and/or per-user, in which case root permissions are not required; this documentation focuses on system-wide usage of hardened_malloc, assumes root - privileges, and assumes the compiled library will be located in a path readable and executable by all - users of the system.
+ privileges, and assumes the compiled library will readable and executable by all users of the + system. +This documentation uses
+ Linux Filesystem Hierarchy Standard
+ paths, with the modern /usr/ merge approach of most Linux distributions. For non-standard
+ configurations, adjust the paths accordingly.
For the complete hardened_malloc documentation, visit its official documentation.
This documentation is also available in portable AsciiDoc format in my @@ -78,6 +82,7 @@ whereas lower values prefer lower memory usage. Note that having too many arenas may cause memory fragmentation and decrease system performance. The number of arenas has no impact on the security properties of hardened_malloc.
+For extra security, CONFIG_SEAL_METADATA=true can be used in order to control
whether
- Memory Protection Keys
+ Memory Protection Keys
are used to disable access to all writable allocator state outside of the memory allocator code.
It's currently disabled by default due to a significant performance cost for this use case on
current-generation hardware. Whether or not this feature is enabled, the metadata is all contained
@@ -107,17 +113,17 @@
the security sacrifices over the full variant.
For all compile-time options, see the configuration section - of hardened_malloc's extensive official documentation.
+ of hardened_malloc's official documentation.# cp out/libhardened_malloc.so <target path>
# cp out/libhardened_malloc.so /usr/local/lib/libhardened_malloc.so
musl-based systems: Add LD_PRELOAD=<hardened_malloc path> to
+
musl-based systems: Add LD_PRELOAD=/usr/local/lib/libhardened_malloc.so to
/etc/environment
glibc-based systems: Add <hardened_malloc path> to
+
glibc-based systems: Add /usr/local/lib/libhardened_malloc.so to
/etc/ld.so.preload