[go-nuts] Security downsides of static linking

[go-nuts] Security downsides of static linking

	Anthony Martin
	Jan 30, 2013 at 3:01 pm

Sebastien Binet once said:
Jan Mercl <0xjnml@gmail.com> writes:

On Wed, Jan 30, 2013 at 1:49 PM, wrote:
I'm the sysadmin
I cannot see which libraries are
linked into a specific go binary.

ldd /path-to-specific-go/binary ?

that doesn't work, indeed, but something based on go/types.GcImporter
could fit the bill:

You don't even need that. Just objdump -t $binary | grep $importpath.

Anthony

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Search Discussions

Discussion Posts

Nate Finch: You should know you're vulnerable because the authors of the binary you're running should tell you what libraries they're using. The same as any other binary authors telling you they use libfoo. You have to trust that when they say they're using libfoo, that they actually are, and not something else. Regardless of whether they link to it or not, they either might not be actually using the linked dll... or they might have renamed/rebuilt it and linked against a private copy... I've seen both of

Follow ups

Kyle Lemons: A few things here. Vulnerabilities in Go will tend to be on a much different axis than vulnerabilities in C/C++. I know some security guys who have spent quite a bit of time hammering at Go and they haven't (without using unsafe) been able to break through the runtime to do anything beyond crash the app in anything resembling normal code, and even that required specifically crafted, racy Go. Problems in Go libraries will tend to be bugs, and will tend to be surfaced in different ways for

Related Discussions

Discussion Navigation

view	thread \| post
posts	‹ prev \| 19 of 20 \| next ›

Discussion Overview

group	golang-nuts @
categories	go
posted	Jan 30, '13 at 10:39a
active	Jan 30, '13 at 5:51p
posts	20
users	13
website	golang.org

font	variable	Hotkey: f
user style	avatars	Hotkey: a

[go-nuts] Security downsides of static linking

Search Discussions

Discussion Posts

Related Discussions

13 users in discussion