Many of Linux Distributions take firefox binaries from https://packages.mozilla.org/apt/ as given in the Mozilla Knowlege Base Article Install Firefox on Linux. In this a… (čitajće wjace)
Many of Linux Distributions take firefox binaries from https://packages.mozilla.org/apt/ as given in the Mozilla Knowlege Base Article Install Firefox on Linux. In this article there is a option to Install Firefox .deb package for Debian-based distributions.
However the binaries and libraries that are hosted in Firefox repositories are not compiled with the PIE/PIC flag. That prevents Firefox browser from using ASLR capabilities and to a large degree prevent Buffer overflows attacks. Please refer to the output given below for more details.
$ file -e elf /opt/firefox/firefox
/opt/firefox/firefox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV)
$
$ readelf -h /opt/firefox/firefox
ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Advanced Micro Devices X86-64
Version: 0x1
The output of the first command is ELF 64-bit LSB executable, which indicates that it is not a PIE executable. If it had been a PIE executable then it would have been ELF 64-bit LSB pie executable. Similarly the output of the second command has a Key, Type, whose value is EXEC (Executable file). However for a PIE binary the value would be DYN (Position-Independent Executable file).
Can Mozilla please compile the binaries and shared libraries with the PIE/PIC flag and then host them in its repositories? Many of Linux Distros do not have the bandwidth to take the source and compile binaries for different architects and are dependent on Mozilla to provide the same.
Doing so would be appreciated and would help in enhancing safety of Linux users who use Firefox as their primary browser.
PIE = Position Independent Executable
PIC = Position Independent Code
ASLR = Address Space Layout Randomisation.
PIC and PIE are used interchangeably and imply the same thing.