>From the comment at https://reviews.freebsd.org/D5603
"The procctl(2) control for ASLR is implemented, [but] I have not provided
a userspace wrapper around the syscall. In fact, the most reasonable
control needed is per-image and not per-process, but we have no
tradition to put the kernel-read attributes into the extattrs of binary,
so I am still pondering that part and this also explains the non-written
tool."
I think its time to revisit the approach. Storing the attributes within
the extattr is preferable to a central file - we're very fortunate to have
the MAC framework, perhaps a MAC_ASLR is required (to identify those
applications that can/can't use ASLR)?
Other applications also make use of protection bits inside extattr, notably
samba4.
References:
https://reviews.freebsd.org/D19281 mac_veriexec: Create kernel module to
parse manifest based on envs.