chatr_ia.1 (2010 09)

c
chatr_ia(1)
Integrity Systems Only
chatr_ia(1)
+mergeseg flag
Enable or disable the shared library segment merging features. When enabled, all data
segments of shared libraries loaded at program startup are merged into a single block.
Data segments for each dynamically loaded library will also be merged with the data seg-
ments of its dependent libraries. Merging of these segments increases run-time perfor-
mance by allowing the kernel to use larger size page table entries.
+mi flag Enable or disable the modification bit for the file’s text segment(s). If this is enabled, it is
denoted by the m flag for the segment listing in the
chatr output.
+o flag Enable or disable the DF_ORIGIN flag to control use of
$ORIGIN in calculating the
absolute path of the working directory. Enabling the flag instructs the dynamic loader to
calculate the absolute path of the current working directory when the parent module
(object module, shared library, or executable) is first loaded. The loader then uses this
path for all occurrences of
$ORIGIN. The loader then uses this path for all occurrences
of $ORIGIN in the dependent libraries.
If there are no occurrences of
$ORIGIN, you should disable the
DF_ORIGIN flag, to
avoid calculating the absolute path. By default, if
$ORIGIN is not present, the
DF_ORIGIN flag is disabled.
+p size (Format 2 only.) Set the page size for a specified segment.
+pd size Request a particular virtual memory page size that should be used for data. Sizes of
4K,
16K, 64K, 256K, 1M, 4M, 16M, 64M, 256M, 1G
, 4G, D, and L are supported. A size of
D results in using the default page size. A size of L results in using the largest page size
available. The actual page size may vary if the requested size cannot be fulfilled.
+pi size Request a particular virtual memory page size that should be used for text (instructions).
See the +pd option for additional information.
+r flag Request static branch prediction when executing this program. The flags enable and
disable turn this request on and off, respectively. If this is enabled, it is denoted by
the r flag for the segment listing in the chatr output.
+rtc flag This is an alias to the chatr +mem_check option.
+s flag Control whether the directory path list specified with the LD_LIBRARY_PATH
and
SHLIB_PATH environment variable can be used to locate shared libraries needed by the
program. The two flag values, enable and disable, respectively enable and disable
use of the environment variable. If both +s and +b are used, their relative order on the
command line indicates which path list will be searched first. See the +b option.
+sa address (Format 2 only.) Specify a segment using an address for a set of attribute modifications.
+sall (Format 2 only.) Use all segments in the file for a set of attribute modifications.
+si index (Format 2 only.) Specify a segment using a segment index number for a set of attribute
modifications.
+z flag Enable or disable lazy swap on all data segments (using FORMAT 1) or on a specific seg-
ment (using 2). The flags enable and disable turn this request on or off respec-
tively. May not be used with non-data segments.
+I flag Enable or disable dynamic instrumentation by /opt/langtools/bin/caliper
.If
enabled, the dynamic loader (see dld.so (5)) will automatically invoke
caliper upon
program execution to collect profile information.
Restricting Execute Permission on Stacks
A frequent or common method of breaking into systems is by maliciously overflowing buffers on a
program’s stack, such as passing unusually long, carefully chosen command line arguments to a
privileged program that does not expect them. Malicious unprivileged users can use this technique to
trick a privileged program into starting a superuser shell for them, or to perform similar unauthorized
actions.
One simple yet highly effective way to reduce the risk from this type of attack is to remove the execute
permission from a program’s stack pages. This improves system security without sacrificing performance
and has no negative effects on the vast majority of legitimate applications. The changes described in this
section only affect the very small number of programs that try to execute (or are tricked into executing)
instructions located on the program’s stack(s).
HP-UX 11i Version 3: September 2010 − 3 − Hewlett-Packard Company 3