/usr/share/doc/samhain/manual.html/dnmalloc.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Remarks on the dnmalloc allocator</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="General usage notes"
HREF="usage.html"><LINK
REL="PREVIOUS"
TITLE="Runtime options: command-line &#38; configuration file"
HREF="options-configuration-file.html"><LINK
REL="NEXT"
TITLE="Support / Bugs / Problems"
HREF="support.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="options-configuration-file.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 3. General usage notes</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="support.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="DNMALLOC"
>3.10. Remarks on the dnmalloc allocator</A
></H1
><P
>As a proactive security measure, since version 2.4.5, 
<SPAN
CLASS="APPLICATION"
>samhain</SPAN
> ships with
<SPAN
CLASS="APPLICATION"
>dnmalloc</SPAN
> 
(<A
HREF="http://fort-knox.org/"
TARGET="_top"
>Dnmalloc Site</A
>), a safer allocator 
that isn't vulnerable by heap buffer overflows and/or double free errors. 
I.e. with dnmalloc, it's not possible to exploit such errors to run 
arbitrary code.</P
><P
>If you want to disable dnmalloc, you can do so at compile time with  
<B
CLASS="COMMAND"
>./configure --disable-dnmalloc [more options]</B
>.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Unsupported operating systems</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The dnmalloc allocator doesn't work on: OpenBSD (problems with pthread
  internals), Cygwin (also pthread internals), and 64bit FreeBSD. On 64bit AIX,
  you need to compile as a 32bit application, or to forego dnmalloc.</P
></TD
></TR
></TABLE
></DIV
><P
>  Speed and memory overhead of dnmalloc:
  <P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>Speed</DT
><DD
><P
>	 Dnmalloc is as fast, or sometimes faster than, the GNU libc 
	 allocator (which is based on ptmalloc).
       </P
></DD
><DT
>Memory overhead</DT
><DD
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Reserved memory</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	  &quot;Reserved momory&quot; is the amount of memory that the 
	  operating system has reserved for an application, is backed by 
	  physical reasources (RAM or swap),
	  and hence is not available for other applications. In other words, 
	  &quot;reserved momory&quot; is the actual resource usage of an 
	  application.
	</P
><P
>	  Because of deferred memory allocation, reserved memory can be 
	  less than what
	  an application has asked for, since memory is only reseved 
	  when it is used.
	</P
></TD
></TR
></TABLE
></DIV
><P
>	  The actual memory overhead of dnmalloc is in the 
	  range of 20 per cent or less.
	</P
><P
>	  On top of that, dnmalloc allocates a huge (128MB/256MB for 
	  32bit/64bit systems) table on startup. <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>This is basically 
	  a non-issue</I
></SPAN
>, since this table is only sparsely used, 
	  and hence contributes very little to the &quot;reserved memory&quot;,
	  i.e. the actual resource usage of dnmalloc.
	</P
><P
>	  Both 'top' and 'ps' include this table in the 'virtual size' 
	  (columns VIRT/VSZ in top/ps) of an application using dnmalloc, thus 
	  giving the incorrect impression that physical swap storage would be 
	  required to back this table, if it's not resident in RAM (columns 
	  RES/RSS in top/ps). In fact, since most parts of this table are 
	  never used, no physical storage (neither RAM nor swap) is ever 
	  reserved for them. Note that this is not true anymore if (on Linux) 
	  you've switched off overcommiting completely 
	  (<B
CLASS="COMMAND"
>echo 2 &#62; /proc/sys/vm/overcommit_memory</B
>).
	</P
></DD
></DL
></DIV
></P
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="options-configuration-file.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="support.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Runtime options: command-line &amp; configuration file</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="usage.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Support / Bugs / Problems</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / dnmalloc.html
