HP-UX Reference (11i v2 07/12) - 1 User Commands A-M (vol 1)

c
chatr_ia(1)
Integrity Systems Only
chatr_ia(1)
+mergeseg flag
Enable or disable the shared library segment merging features. When enabled, all data
segments of shared libraries loaded at program startup are merged into a single block.
Data segments for each dynamically loaded library will also be merged with the data seg-
ments of its dependent libraries. Merging of these segments increases run-time perfor-
mance by allowing the kernel to use larger size page table entries.
+mi flag Enable or disable the modification bit for the file’s text segment(s). If this is enabled, it is
denoted by the m flag for the segment listing in the
chatr output.
+o flag Enable or disable the DF_ORIGIN flag to control use of
$ORIGIN in calculating the abso-
lute path of the working directory. Enabling the flag instructs the dynamic loader to calcu-
late the absolute path of the current working directory when the parent module (object
module, shared library, or executable) is first loaded. The loader then uses this path for all
occurrences of
$ORIGIN. The loader then uses this path for all occurrences of
$ORIGIN
in the dependent libraries.
If there are no occurrences of $ORIGIN, you should disable the
DF_ORIGIN flag, to avoid
calculating the absolute path. By default, if
$ORIGIN is not present, the DF_ORIGIN
flag is disabled.
+p size (Format 2 only.) Set the page size for a specified segment.
+pd size Request a particular virtual memory page size that should be used for data. Sizes of
4K,
16K, 64K, 256K, 1M, 4M, 16M, 64M, 256M,
1G, 4G, D, and L are supported. A size of
D results in using the default page size. A size of L results in using the largest page size
available. The actual page size may vary if the requested size cannot be fulfilled.
+pi size Request a particular virtual memory page size that should be used for text (instructions).
See the +pd option for additional information.
+r flag Request static branch prediction when executing this program. The flags enable and
disable turn this request on and off, respectively. If this is enabled, it is denoted by the
r flag for the segment listing in the chatr output.
+s flag Control whether the directory path list specified with the LD_LIBRARY_PATH
and
SHLIB_PATH environment variable can be used to locate shared libraries needed by the
program. The two flag values, enable and disable, respectively enable and disable
use of the environment variable. If both +s and +b are used, their relative order on the
command line indicates which path list will be searched first. See the +b option.
+sa address (Format 2 only.) Specify a segment using an address for a set of attribute modifications.
+sall (Format 2 only.) Use all segments in the file for a set of attribute modifications.
+si index (Format 2 only.) Specify a segment using a segment index number for a set of attribute
modifications.
+z flag Enable or disable lazy swap on all data segments (using FORMAT 1) or on a specific seg-
ment (using 2). The flags enable and disable turn this request on or off respectively.
May not be used with non-data segments.
+I flag Enable or disable dynamic instrumentation by /opt/langtools/bin/caliper
.If
enabled, the dynamic loader (see dld.so(5)) will automatically invoke
caliper upon pro-
gram execution to collect profile information.
Restricting Execute Permission on Stacks
A frequent or common method of breaking into systems is by maliciously overflowing buffers on a program’s
stack, such as passing unusually long, carefully chosen command line arguments to a privileged program
that does not expect them. Malicious unprivileged users can use this technique to trick a privileged pro-
gram into starting a superuser shell for them, or to perform similar unauthorized actions.
One simple yet highly effective way to reduce the risk from this type of attack is to remove the execute per-
mission from a program’s stack pages. This improves system security without sacrificing performance and
has no negative effects on the vast majority of legitimate applications. The changes described in this sec-
tion only affect the very small number of programs that try to execute (or are tricked into executing)
instructions located on the program’s stack(s).
If the stack protection feature described in this section is enabled for a program and that program attempts
to execute code from its stack(s), the HP-UX kernel will terminate the program with a SIGKILL signal,
HP-UX 11i Version 2: December 2007 Update − 3 − Hewlett-Packard Company 131