Query on Address space layout randomization(ASLR) in Fluentd

[chaitrahegde115]

Hi,
There is a security requirement which states applications has to be compiled using modern ASLR techniques. Does Fluentd support this?

[chaitrahegde115]

Any updates here?

[Garfield96]

Hi,
I'm not a security expert, but I'll try to answer your question. Therefore, please understand that I'll not take any liability for the following answer:
ASLR is a kernel feature. E.g. Linux usually does it by default for shared libraries. To enable it for application binaries, they must be compiled as position-independent executables.
Fluentd is written in Ruby, which is an interpreted language, and memory management is done by the Ruby runtime. Therefore, there is very little FluentD can do to harden the executable. However, you can check whether your Ruby version is optimized for security (for ASLR it is relevant to check, whether it was compiled as a position-independent executable (build options fPIE -pie)). The answer might differ depending on your distro and the way how you installed it.
Fluentd has several dependencies, which include native extensions. Native extensions get compiled during the installation of Fluentd. The security options used for these dependencies depend on the system's defaults and the options set in the dependency itself.
It is important to mention, that there are several other compiler options (fortify, stack protector, etc.) which should be used as well to increase security. Debian has assembled an overview of different security-related compiler options: https://wiki.debian.org/Hardening#User_Space