Enabling EFI runtime services provides a venue for injecting code into
the kernel.
When grsecurity is enabled, we close this by default by disabling access
to EFI runtime services. The upshot of this is that
/sys/firmware/efi/efivars will be unavailable by default (and attempts
to mount it will fail).
This is not strictly a grsecurity related option, it could be made into
a general option, but it seems to be of particular interest to
grsecurity users (for non-grsecurity users, there are other, more
immediate kernel injection attack dangers to contend with anyway).
Looks like mostly performance enhancements and stability fixes. The main
user facing changes appear to be:
- The -Z option was removed
- A macro named FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is defined when
compiling with afl-gcc
Full changelog at http://lcamtuf.coredump.cx/afl/ChangeLog.txt
Few tests fail with python35 (related to OrderedDict changes).
setup.py file do not report this release as supporting python35 [1]
[1] f6aa74a0b5/setup.py (L73-L75)
Only tests cannot run on python3* because dependencies are unavailable
(qpid-python). Kombu is announced to work fine for python3[1]
[1] a4edc670f4/setup.py (L168-L170)
The patch is from the following Gentoo bug:
https://bugs.gentoo.org/show_bug.cgi?id=523326#c24
Built successfully against Linux 3.18.36, 4.4.16 and 4.7.0.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @phreedom, @vcunat
The patch for kernel version 3.18 is already applied upstream, so we
don't need it any longer.
Without i686-build-failure.patch, the build for i686-linux fails because
it references rdtscl(), which is no longer available in Linux 4.3.0.
Patch for missing rdtscl() is from Arch Linux:
https://aur.archlinux.org/cgit/aur.git/tree/002-rdtscl.patch?h=broadcom-wl-ck
I've tested building against 32 and 64 bit Linux versions 3.18.36,
4.4.16 and 4.7.0.
The hashes were verified using the ones from the AUR (using the 16 bit
hashes of course):
$ nix-hash --type sha256 --to-base16 1kaqa2dw3nb8k23ffvx46g8jj3wdhz8xa6jp1v3wb35cjfr712sg
4f8b70b293ac8cc5c70e571ad5d1878d0f29d133a46fe7869868d9c19b5058cd
$ nix-hash --type sha256 --to-base16 1gj485qqr190idilacpxwgqyw21il03zph2rddizgj7fbd6pfyaz
5f79774d5beec8f7636b59c0fb07a03108eef1e3fd3245638b20858c714144be
AUR hashes can be found at:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=broadcom-wl&id=9d6f10b1b7745fbf5d140ac749e2253caf70daa8#n26
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @phreedom, @vcunat
