more -fstack-protector!

Thu Mar 7 05:07:36 MST 2013

On Thursday 07 March 2013 21:20:24 Andrew Bartlett wrote:
> On Thu, 2013-03-07 at 10:51 +0100, Andreas Schneider wrote:
> > On Thursday 07 March 2013 13:09:58 Andrew Bartlett wrote:
> > > On Wed, 2013-03-06 at 19:08 -0500, Ira Cooper wrote:
> > > > On Wed, Mar 6, 2013 at 6:16 PM, Andrew Bartlett <abartlet at samba.org>
> > 
> > wrote:
> > > > > On Wed, 2013-03-06 at 09:22 -0500, Ira Cooper wrote:
> > > > > > This patch adds the ability to:
> > > > > > 
> > > > > > --disable-stack-protector (For those who don't want it.)
> > > > > > --enable-stack-protector-all (For debugging or the paranoid.)
> > > > > > 
> > > > > > Both builds have been tested locally on illumos.  (As far as that
> > > > > > they
> > > > > > build.)
> > > > > > 
> > > > > > In the future, please don't default flags like this, without a
> > > > > > toggle
> > > > > > to
> > > > > > turn them off.
> > > > > 
> > > > > On a more meta level:
> > > > > 
> > > > > In Samba, with very, very few fixed-length strings on the stack
> > > > > (die,
> > > > > pstring, die), where does -fstack-protector help?  Can we get some
> > > > > diagnostics as to where this is being applied, such that the cost 1%
> > > > > cost is showing up?
> > > > 
> > > > Sorry,
> > > > 
> > > > I've got other things to work on.  The only reason I actually jumped
> > > > in at
> > > > all was it broke my build, and then I realized I only 1/2 fixed what
> > > > was
> > > > wrong, so I mopped up my work.
> > > > 
> > > > Others appear to have a better grasp on what is going on.  I just want
> > > > a
> > > > way to turn it off.
> > > 
> > > You suggested this option has a speed cost.  I'm at the very least
> > > asking that you detail that.
> > 
> > fstack-protector puts a canary value on the stack of key functions. Just
> > before the return address and just before returning from that value, that
> > canary value is verified. If there was a buffer overflow, the canary no
> > longer matches and the program aborts. The canary value is random for
> > each time the application is started and makes it impossible to guess
> > remotely.
> > 
> > The speed cost is setting and checking the canary...
> 
> It seems incredible to me that this, if properly applied (eg the
> criteria we discuss below) can really cost 1%, which is why I'm wanting
> detail.
> 
> > Red Hat and SUSE are are using it by default ...
> > 
> > > I don't like having any more configure options that we absolutely have
> > > to have, because each of them has to be tested somehow.  Where at all
> > > possible we should just do the right thing, whatever that is.
> > > 
> > > As such, I would like detail from you and from those who added this in
> > > the first place as to what the costs and specific benefits are.
> > 
> > It is a stack smash protection.
> 
> Given the way we handle strings and buffers in Samba, can you point at
> the buffers you think might be subject to such an attack?
> 
> > > In particular, what array declarations 'buffers larger than 8 bytes'
> > > does the compiler see in our hot path?
> > 
> > I don't see what this has todo with buffers larger than 8 bytes. This is
> > for buffer overflow detection for any buffer.
> 
> That is a quote from the GCC manpage on my Fedora 17 box.  I take it
> that this is the default criteria for it guessing that a buffer is a
> string or something a bad memcpy() might be aimed at, rather than just
> integers (for example), and so to apply this protection to that
> particular function:
> 
>        -fstack-protector
>            Emit extra code to check for buffer overflows, such as stack
> smashing attacks.  This is done by adding a guard variable to functions
> with vulnerable objects.  This includes
>            functions that call alloca, and functions with buffers larger
> than 8 bytes.  The guards are initialized when a function is entered and
> then checked when the function exits.
>            If a guard check fails, an error message is printed and the
> program exits.
> 
>        -fstack-protector-all
>            Like -fstack-protector except that all functions are
> protected.
> 
> 
> If this really has a 1% cost (which seems high, and now I can't find the
> reference where I thought that was stated), I would like to see the
> intersection between the hot path and functions that need stack smash
> protection, to see if we might find a way to avoid it on those hot paths
> (perhaps with some small re-factor, or assistance to upstream GCC to be
> smarter).

I've talked to Marcus Meissner and he told me that it is less then 1%. They 
have tested it with SPEC2000 some time ago.

The library with the most canries is libwireshark

objdump -d /usr/lib64/libwireshark.so.2.0.5 | grep xor.*fs:0x28 | wc -l
49197

So here is a list of samba binaries:

bin/default/lib/ntdb/ntdbtool canary count = 0
bin/default/lib/ntdb/ntdbtorture canary count = 0
bin/default/lib/ntdb/ntdbdump canary count = 0
bin/default/lib/ntdb/ntdbbackup canary count = 0
bin/default/lib/ntdb/ntdbrestore canary count = 2
bin/default/lib/tdb/tdbrestore canary count = 2
bin/default/lib/tdb/tdbtool canary count = 0
bin/default/lib/tdb/tdbbackup canary count = 0
bin/default/lib/tdb/tdbtorture canary count = 0
bin/default/lib/tdb/tdbdump canary count = 0
bin/default/lib/ldb/ldbtest canary count = 0
bin/default/lib/ldb/ldbrename canary count = 0
bin/default/lib/ldb/ldbmodify canary count = 0
bin/default/lib/ldb/ldbedit canary count = 1
bin/default/lib/ldb/ldbdump canary count = 0
bin/default/lib/ldb/ldbsearch canary count = 1
bin/default/lib/ldb/ldbadd canary count = 0
bin/default/lib/ldb/ldbdel canary count = 0
bin/default/testsuite/headers/test_headers canary count = 0
bin/default/libcli/nbt/nmblookup4 canary count = 0
bin/default/source3/smbd/smbd canary count = 2
bin/default/source3/smbconftort canary count = 0
bin/default/source3/debug2html canary count = 2
bin/default/source3/lib/asys/asystest canary count = 0
bin/default/source3/lib/netapi/tests/netapitest canary count = 0
bin/default/source3/lib/pthreadpool/pthreadpooltest canary count = 0
bin/default/source3/pdbtest canary count = 2
bin/default/source3/nmblookup canary count = 26
bin/default/source3/smbpasswd canary count = 6
bin/default/source3/smbcquotas canary count = 1
bin/default/source3/vfstest canary count = 3
bin/default/source3/smbcontrol canary count = 2
bin/default/source3/smbtorture3 canary count = 40
bin/default/source3/rpc_open_tcp canary count = 0
bin/default/source3/split_tokens canary count = 0
bin/default/source3/msgtest canary count = 1
bin/default/source3/pdbedit canary count = 3
bin/default/source3/rpcclient/rpcclient canary count = 32
bin/default/source3/test_lp_load canary count = 0
bin/default/source3/versiontest canary count = 0
bin/default/source3/smbget canary count = 5
bin/default/source3/dbwrap_torture canary count = 0
bin/default/source3/smbtree canary count = 2
bin/default/source3/log2pcap canary count = 1
bin/default/source3/testparm canary count = 0
bin/default/source3/web/swat canary count = 16
bin/default/source3/profiles canary count = 1
bin/default/source3/vlp canary count = 6
bin/default/source3/replacetort canary count = 8
bin/default/source3/dbwrap_tool canary count = 0
bin/default/source3/sharesec canary count = 2
bin/default/source3/smbfilter canary count = 23
bin/default/source3/smbcacls canary count = 3
bin/default/source3/net canary count = 79
bin/default/source3/ntlm_auth canary count = 20
bin/default/source3/smbta-util canary count = 2
bin/default/source3/locktest2 canary count = 1
bin/default/source3/client/smbclient canary count = 13
bin/default/source3/nmbd/nmbd canary count = 90
bin/default/source3/smbspool canary count = 2
bin/default/source3/eventlogadm canary count = 2
bin/default/source3/smbstatus canary count = 1
bin/default/source3/timelimit canary count = 0
bin/default/source3/winbindd/winbindd canary count = 74
bin/default/source4/smbd/samba canary count = 0
bin/default/source4/utils/oLschema2ldif canary count = 1
bin/default/source4/utils/ntlm_auth4 canary count = 3
bin/default/source4/lib/registry/regshell canary count = 0
bin/default/source4/lib/registry/regdiff canary count = 0
bin/default/source4/lib/registry/regpatch canary count = 0
bin/default/source4/lib/registry/regtree canary count = 0
bin/default/source4/torture/smbtorture canary count = 527
bin/default/source4/torture/locktest canary count = 6
bin/default/source4/torture/masktest canary count = 7
bin/default/source4/torture/gentest canary count = 6
bin/default/source4/heimdal_build/samba4kgetcred canary count = 0
bin/default/source4/heimdal_build/asn1_compile canary count = 5
bin/default/source4/heimdal_build/samba4kpasswd canary count = 1
bin/default/source4/heimdal_build/compile_et canary count = 5
bin/default/source4/heimdal_build/rkpty canary count = 1
bin/default/source4/heimdal_build/samba4kinit canary count = 2
bin/default/source4/client/smbclient4 canary count = 3
bin/default/source4/client/cifsdd canary count = 7
bin/default/librpc/tools/ndrdump canary count = 1
bin/default/nsswitch/wbinfo canary count = 12
bin/default/nsswitch/nsstest canary count = 0

and libraries

bin/default/lib/ntdb/libntdb.so canary count = 4
bin/default/lib/ntdb/pyntdb.so canary count = 0
bin/default/lib/uid_wrapper/libuid_wrapper.so canary count = 0
bin/default/lib/tdb_wrap/libtdb-wrap.so canary count = 0
bin/default/lib/param/libsamba-hostconfig.so canary count = 0
bin/default/lib/param/libserver-role.so canary count = 0
bin/default/lib/ccan/libccan.so canary count = 1
bin/default/lib/replace/libreplace.so canary count = 0
bin/default/lib/dbwrap/libdbwrap.so canary count = 0
bin/default/lib/tdb/libtdb.so canary count = 3
bin/default/lib/tdb/pytdb.so canary count = 0
bin/default/lib/torture/libtorture.so canary count = 1
bin/default/lib/ldb-samba/libldbsamba.so canary count = 6
bin/default/lib/ldb-samba/python-samba--ldb.so canary count = 0
bin/default/lib/ldb-samba/libldb-ildap.so canary count = 0
bin/default/lib/ldb-samba/libldbsamba-extensions.so canary count = 0
bin/default/lib/krb5_wrap/libkrb5samba.so canary count = 3
bin/default/lib/tdb_compat/libtdb_compat.so canary count = 0
bin/default/lib/socket_wrapper/py-socket-wrapper.so canary count = 10
bin/default/lib/socket_wrapper/libsocket_wrapper.so canary count = 11
bin/default/lib/talloc/libtalloc.so canary count = 0
bin/default/lib/talloc/pytalloc.so canary count = 0
bin/default/lib/talloc/libpytalloc-util.so canary count = 0
bin/default/lib/ldb/libldb-asq.so canary count = 0
bin/default/lib/ldb/libldb-tdb.so canary count = 0
bin/default/lib/ldb/libldb-skel.so canary count = 0
bin/default/lib/ldb/libldb-cmdline.so canary count = 0
bin/default/lib/ldb/libldb-paged-searches.so canary count = 0
bin/default/lib/ldb/libldb.so canary count = 7
bin/default/lib/ldb/libldb-sample.so canary count = 0
bin/default/lib/ldb/libldb-rdn-name.so canary count = 0
bin/default/lib/ldb/libldb-paged-results.so canary count = 0
bin/default/lib/ldb/libpyldb-util.so canary count = 0
bin/default/lib/ldb/libldb-server-sort.so canary count = 0
bin/default/lib/ldb/pyldb.so canary count = 0
bin/default/lib/libsamba-sockets.so canary count = 25
bin/default/lib/util/libutil_setid.so canary count = 0
bin/default/lib/util/libutil_ntdb.so canary count = 0
bin/default/lib/util/libsamba-modules.so canary count = 0
bin/default/lib/util/libtevent-util.so canary count = 0
bin/default/lib/util/libasn1util.so canary count = 0
bin/default/lib/util/libutil_tdb.so canary count = 0
bin/default/lib/util/libsamba-util.so canary count = 34
bin/default/lib/socket/libinterfaces.so canary count = 0
bin/default/lib/nss_wrapper/libnss_wrapper.so canary count = 0
bin/default/lib/addns/libaddns.so canary count = 11
bin/default/lib/subunit/c/libsubunit.so canary count = 0
bin/default/python/libsamba_python.so canary count = 0
bin/default/python/python-glue.so canary count = 0
bin/default/libcli/security/pysecurity.so canary count = 0
bin/default/libcli/security/libsamba-security.so canary count = 1
bin/default/libcli/ldap/libcli-ldap-common.so canary count = 0
bin/default/libcli/named_pipe_auth/libnpa_tstream.so canary count = 0
bin/default/libcli/cldap/libcli_cldap.so canary count = 0
bin/default/libcli/smb/libcli_smb_common.so canary count = 13
bin/default/libcli/smb/libsmb_transport.so canary count = 0
bin/default/libcli/util/liberrors.so canary count = 0
bin/default/libcli/auth/libcliauth.so canary count = 49
bin/default/libcli/registry/libutil_reg.so canary count = 0
bin/default/libcli/nbt/python-netbios.so canary count = 0
bin/default/libcli/nbt/libcli-nbt.so canary count = 2
bin/default/source3/libsmbldap.so canary count = 2
bin/default/source3/libsmbsharemodes.so canary count = 0
bin/default/source3/passdb/libpdb-wbc-sam.so canary count = 0
bin/default/source3/passdb/pypassdb.so canary count = 1
bin/default/source3/passdb/libpdb-ldapsam.so canary count = 16
bin/default/source3/passdb/libpdb-smbpasswd.so canary count = 2
bin/default/source3/passdb/libpdb-tdbsam.so canary count = 8
bin/default/source3/libnetapi.so canary count = 9
bin/default/source3/libsmbldaphelper.so canary count = 1
bin/default/source3/libpdb.so canary count = 19
bin/default/source3/libsmbconf.so canary count = 30
bin/default/source3/liblibsmb.so canary count = 57
bin/default/source3/modules/libvfs-dirsort.so canary count = 0
bin/default/source3/modules/libvfs-aio-posix.so canary count = 0
bin/default/source3/modules/libperfcount-test.so canary count = 0
bin/default/source3/modules/libvfs-shadow-copy.so canary count = 0
bin/default/source3/modules/libvfs-fileid.so canary count = 0
bin/default/source3/modules/libvfs-full-audit.so canary count = 1
bin/default/source3/modules/libvfs-posix-eadb.so canary count = 0
bin/default/source3/modules/libvfs-preopen.so canary count = 0
bin/default/source3/modules/libvfs-syncops.so canary count = 0
bin/default/source3/modules/libvfs-fake-perms.so canary count = 0
bin/default/source3/modules/libvfs-crossrename.so canary count = 0
bin/default/source3/modules/libvfs-media-harmony.so canary count = 0
bin/default/source3/modules/libvfs-scannedonly.so canary count = 1
bin/default/source3/modules/libvfs-readahead.so canary count = 0
bin/default/source3/modules/libvfs-commit.so canary count = 0
bin/default/source3/modules/libvfs-streams-xattr.so canary count = 1
bin/default/source3/modules/libvfs-catia.so canary count = 1
bin/default/source3/modules/libvfs-netatalk.so canary count = 0
bin/default/source3/modules/libvfs-linux-xfs-sgid.so canary count = 0
bin/default/source3/modules/libvfs-fake-acls.so canary count = 0
bin/default/source3/modules/libvfs-acl-xattr.so canary count = 5
bin/default/source3/modules/libvfs-cap.so canary count = 0
bin/default/source3/modules/libvfs-streams-depot.so canary count = 1
bin/default/source3/modules/libvfs-extd-audit.so canary count = 0
bin/default/source3/modules/libvfs-cacheprime.so canary count = 0
bin/default/source3/modules/libvfs-default-quota.so canary count = 0
bin/default/source3/modules/libvfs-time-audit.so canary count = 1
bin/default/source3/modules/libvfs-xattr-tdb.so canary count = 0
bin/default/source3/modules/libvfs-aio-fork.so canary count = 2
bin/default/source3/modules/libvfs-recycle.so canary count = 0
bin/default/source3/modules/libvfs-readonly.so canary count = 1
bin/default/source3/modules/libvfs-shadow-copy2.so canary count = 2
bin/default/source3/modules/libvfs-audit.so canary count = 0
bin/default/source3/modules/libnon_posix_acls.so canary count = 0
bin/default/source3/modules/libvfs-smb-traffic-analyzer.so canary count = 4
bin/default/source3/modules/libvfs-acl-tdb.so canary count = 8
bin/default/source3/modules/libvfs-expand-msdfs.so canary count = 1
bin/default/source3/modules/libvfs-aio-pthread.so canary count = 0
bin/default/source3/libpopt_samba3.so canary count = 2
bin/default/source3/libutil_cmdline.so canary count = 1
bin/default/source3/libsmbd_conn.so canary count = 0
bin/default/source3/libtrusts_util.so canary count = 3
bin/default/source3/libsecrets3.so canary count = 6
bin/default/source3/libads.so canary count = 17
bin/default/source3/libgpo.so canary count = 2
bin/default/source3/pylibsmb.so canary count = 2
bin/default/source3/libmsrpc3.so canary count = 3
bin/default/source3/libCHARSET3.so canary count = 0
bin/default/source3/libnet_keytab.so canary count = 0
bin/default/source3/libprinting_migrate.so canary count = 0
bin/default/source3/liblibcli_lsa3.so canary count = 0
bin/default/source3/libxattr_tdb.so canary count = 2
bin/default/source3/libnss-wins.so canary count = 2
bin/default/source3/libsamba3-util.so canary count = 1
bin/default/source3/libcli_spoolss.so canary count = 0
bin/default/source3/pys3param.so canary count = 0
bin/default/source3/libgse.so canary count = 25
bin/default/source3/libsmbd_base.so canary count = 167
bin/default/source3/auth/libauth-samba4.so canary count = 0
bin/default/source3/auth/libauth-script.so canary count = 1
bin/default/source3/auth/libauth.so canary count = 18
bin/default/source3/libsmbd_shim.so canary count = 0
bin/default/source3/libsmbregistry.so canary count = 2
bin/default/source3/libsmb/libsmbclient.so canary count = 9
bin/default/source3/liblibcli_netlogon3.so canary count = 5
bin/default/source3/pysmbd.so canary count = 0
bin/default/source3/winbindd/libidmap-rid.so canary count = 0
bin/default/source3/winbindd/libidmap.so canary count = 1
bin/default/source3/winbindd/libidmap-ldap.so canary count = 0
bin/default/source3/winbindd/libidmap-ad.so canary count = 1
bin/default/source3/winbindd/libnss-info-sfu20.so canary count = 1
bin/default/source3/winbindd/libnss-info-sfu.so canary count = 1
bin/default/source3/winbindd/libidmap-autorid.so canary count = 2
bin/default/source3/winbindd/libnss_info.so canary count = 0
bin/default/source3/winbindd/libnss-info-hash.so canary count = 3
bin/default/source3/winbindd/libidmap-hash.so canary count = 3
bin/default/source3/winbindd/libidmap-tdb2.so canary count = 1
bin/default/source3/winbindd/libnss-info-rfc2307.so canary count = 1
bin/default/source4/smbd/libprocess_model.so canary count = 0
bin/default/source4/smbd/libprocess-model-standard.so canary count = 0
bin/default/source4/smbd/libprocess-model-prefork.so canary count = 0
bin/default/source4/smbd/libprocess-model-onefork.so canary count = 0
bin/default/source4/smbd/libservice.so canary count = 1
bin/default/source4/wrepl_server/libservice-wrepl.so canary count = 0
bin/default/source4/ntvfs/posix/python-xattr-tdb.so canary count = 0
bin/default/source4/ntvfs/posix/python-xattr-native.so canary count = 0
bin/default/source4/ntvfs/posix/python-posix-eadb.so canary count = 0
bin/default/source4/ntvfs/posix/libposix_eadb.so canary count = 0
bin/default/source4/ntvfs/libntvfs.so canary count = 5
bin/default/source4/lib/samba3/libsmbpasswdparser.so canary count = 0
bin/default/source4/lib/messaging/libMESSAGING.so canary count = 0
bin/default/source4/lib/messaging/python-messaging.so canary count = 0
bin/default/source4/lib/com/pycom.so canary count = 0
bin/default/source4/lib/policy/py-policy.so canary count = 0
bin/default/source4/lib/policy/libsamba-policy.so canary count = 1
bin/default/source4/lib/events/libevents.so canary count = 0
bin/default/source4/lib/cmdline/libcmdline-credentials.so canary count = 0
bin/default/source4/lib/socket/libnetif.so canary count = 5
bin/default/source4/lib/registry/libregistry.so canary count = 1
bin/default/source4/lib/registry/py-registry.so canary count = 0
bin/default/source4/libnet/python-net.so canary count = 1
bin/default/source4/libnet/libsamba-net.so canary count = 9
bin/default/source4/libnet/python-dckeytab.so canary count = 0
bin/default/source4/rpc_server/libservice-dcerpc.so canary count = 0
bin/default/source4/rpc_server/libdcerpc-server.so canary count = 12
bin/default/source4/cldap_server/libservice-cldap.so canary count = 0
bin/default/source4/param/libshares.so canary count = 0
bin/default/source4/param/pyparam.so canary count = 0
bin/default/source4/libcli/wbclient/libLIBWBCLIENT_OLD.so canary count = 0
bin/default/source4/libcli/libsmbclient-raw.so canary count = 20
bin/default/source4/libcli/ldap/libcli-ldap.so canary count = 4
bin/default/source4/libcli/pysmb.so canary count = 3
bin/default/source4/smb_server/libservice-smb.so canary count = 0
bin/default/source4/ntp_signd/libservice-ntp-signd.so canary count = 1
bin/default/source4/librpc/python-dcerpc-misc.so canary count = 0
bin/default/source4/librpc/python-dcerpc-smb-acl.so canary count = 0
bin/default/source4/librpc/python-dcerpc-dnsp.so canary count = 0
bin/default/source4/librpc/python-netlogon.so canary count = 0
bin/default/source4/librpc/libndr-samba4.so canary count = 0
bin/default/source4/librpc/python-winreg.so canary count = 0
bin/default/source4/librpc/python-svcctl.so canary count = 0
bin/default/source4/librpc/python-dcerpc-security.so canary count = 0
bin/default/source4/librpc/python-epmapper.so canary count = 0
bin/default/source4/librpc/python-dcerpc.so canary count = 0
bin/default/source4/librpc/libdcerpc-atsvc.so canary count = 0
bin/default/source4/librpc/python-wkssvc.so canary count = 0
bin/default/source4/librpc/python-samr.so canary count = 0
bin/default/source4/librpc/python-winbind.so canary count = 0
bin/default/source4/librpc/libdcerpc-samba4.so canary count = 0
bin/default/source4/librpc/libdcerpc.so canary count = 8
bin/default/source4/librpc/python-echo.so canary count = 0
bin/default/source4/librpc/python-drsuapi.so canary count = 2
bin/default/source4/librpc/python-dcerpc-drsblobs.so canary count = 2
bin/default/source4/librpc/python-dns.so canary count = 0
bin/default/source4/librpc/python-unixinfo.so canary count = 0
bin/default/source4/librpc/python-idmap.so canary count = 0
bin/default/source4/librpc/python-krb5pac.so canary count = 0
bin/default/source4/librpc/python-dcerpc-xattr.so canary count = 0
bin/default/source4/librpc/python-initshutdown.so canary count = 0
bin/default/source4/librpc/python-dnsserver.so canary count = 0
bin/default/source4/librpc/python-dcerpc-idmap.so canary count = 0
bin/default/source4/librpc/python-mgmt.so canary count = 0
bin/default/source4/librpc/python-srvsvc.so canary count = 0
bin/default/source4/librpc/python-atsvc.so canary count = 0
bin/default/source4/librpc/python-irpc.so canary count = 0
bin/default/source4/librpc/python-auth.so canary count = 0
bin/default/source4/librpc/python-server-id.so canary count = 0
bin/default/source4/librpc/libdcerpc-samr.so canary count = 0
bin/default/source4/librpc/python-lsa.so canary count = 0
bin/default/source4/librpc/python-dfs.so canary count = 0
bin/default/source4/librpc/python-dcerpc-nbt.so canary count = 0
bin/default/source4/winbind/libservice-winbind.so canary count = 2
bin/default/source4/dns_server/libservice-dns.so canary count = 0
bin/default/source4/dns_server/libdlz_bind9_for_torture.so canary count = 0
bin/default/source4/dns_server/libdlz-bind9-9.so canary count = 0
bin/default/source4/dns_server/libdlz-bind9.so canary count = 0
bin/default/source4/cluster/libcluster.so canary count = 0
bin/default/source4/kdc/libservice-kdc.so canary count = 1
bin/default/source4/kdc/libpac.so canary count = 0
bin/default/source4/kdc/libHDB_SAMBA4.so canary count = 0
bin/default/source4/kdc/libmit-samba.so canary count = 0
bin/default/source4/kdc/libdb-glue.so canary count = 1
bin/default/source4/dsdb/libsamdb.so canary count = 2
bin/default/source4/dsdb/libservice-drepl.so canary count = 3
bin/default/source4/dsdb/samdb/ldb_modules/libldb-repl-meta-data.so canary 
count = 1
bin/default/source4/dsdb/samdb/ldb_modules/libldb-partition.so canary count = 
0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-aclread.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-dirsync.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-password-hash.so canary 
count = 2
bin/default/source4/dsdb/samdb/ldb_modules/libldb-samba3sam.so canary count = 
1
bin/default/source4/dsdb/samdb/ldb_modules/libldb-samba-secrets.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-lazy-commit.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-objectclass-attrs.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-extended-dn-out.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-subtree-rename.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-objectclass.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-descriptor.so canary count = 
0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-resolve-oids.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-objectguid.so canary count = 
0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-extended-dn-store.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-new-partition.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-schema-data.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-samldb.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-extended-dn-in.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-acl.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-local-password.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-ranged-results.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libdsdb-module.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-schema-load.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-anr.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-instancetype.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-subtree-delete.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-simple-ldap-map.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-linked-attributes.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-secrets-tdb-sync.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-operational.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-simple-dn.so canary count = 
0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-show-deleted.so canary count 
= 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-rootdse.so canary count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-update-keytab.so canary 
count = 0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-samba3sid.so canary count = 
0
bin/default/source4/dsdb/samdb/ldb_modules/libldb-samba-dsdb.so canary count = 
0
bin/default/source4/dsdb/python-dsdb.so canary count = 0
bin/default/source4/dsdb/libsamdb-common.so canary count = 1
bin/default/source4/dsdb/libservice-dns-update.so canary count = 0
bin/default/source4/dsdb/libservice-kcc.so canary count = 7
bin/default/source4/ldap_server/libservice-ldap.so canary count = 1
bin/default/source4/web_server/libservice-web.so canary count = 1
bin/default/source4/auth/libauth_unix_token.so canary count = 0
bin/default/source4/auth/kerberos/libauthkrb5.so canary count = 0
bin/default/source4/auth/gensec/pygensec.so canary count = 0
bin/default/source4/auth/gensec/libgensec-krb5.so canary count = 1
bin/default/source4/auth/pyauth.so canary count = 0
bin/default/source4/auth/ntlm/libauth4.so canary count = 4
bin/default/source4/heimdal_build/libkdc-samba4.so canary count = 6
bin/default/source4/heimdal_build/libhdb-samba4.so canary count = 4
bin/default/source4/heimdal_build/libhcrypto-samba4.so canary count = 36
bin/default/source4/heimdal_build/libasn1-samba4.so canary count = 0
bin/default/source4/heimdal_build/libkrb5-samba4.so canary count = 71
bin/default/source4/heimdal_build/libheimbase-samba4.so canary count = 0
bin/default/source4/heimdal_build/libwind-samba4.so canary count = 0
bin/default/source4/heimdal_build/libhx509-samba4.so canary count = 11
bin/default/source4/heimdal_build/libgssapi-samba4.so canary count = 22
bin/default/source4/heimdal_build/libheimntlm-samba4.so canary count = 12
bin/default/source4/heimdal_build/libroken-samba4.so canary count = 7
bin/default/source4/nbt_server/libservice-nbtd.so canary count = 0
bin/default/source4/nbt_server/libldb-wins-ldb.so canary count = 0
bin/default/librpc/libndr-standard.so canary count = 0
bin/default/librpc/libndr-nbt.so canary count = 0
bin/default/librpc/libdcerpc-binding.so canary count = 0
bin/default/librpc/libdcerpc-samba.so canary count = 4
bin/default/librpc/libndr.so canary count = 5
bin/default/librpc/libndr-krb5pac.so canary count = 0
bin/default/librpc/libndr-samba.so canary count = 3
bin/default/nsswitch/libnss-winbind.so canary count = 13
bin/default/nsswitch/libnss-wrapper-winbind.so canary count = 13
bin/default/nsswitch/libpamwinbind.so canary count = 2
bin/default/nsswitch/libwinbind-krb5-locator.so canary count = 0
bin/default/nsswitch/libwinbind-client.so canary count = 4
bin/default/nsswitch/libwbclient/libwbclient.so canary count = 45
bin/default/examples/VFS/libvfs-skel-transparent.so canary count = 0
bin/default/examples/VFS/libvfs-skel-opaque.so canary count = 0
bin/default/examples/VFS/libvfs-shadow-copy-test.so canary count = 0
bin/default/examples/pdb/libpdb-test.so canary count = 0
bin/default/examples/auth/libauth-skel.so canary count = 0
bin/default/dfs_server/libdfs_server_ad.so canary count = 0
bin/default/auth/libauth_sam_reply.so canary count = 0
bin/default/auth/gensec/libgensec.so canary count = 7
bin/default/auth/credentials/libsamba-credentials.so canary count = 3
bin/default/auth/credentials/pycredentials.so canary count = 0
bin/default/libds/common/libflag_mapping.so canary count = 0
bin/default/file_server/libservice-s3fs.so canary count = 0

So they are really low ...

	-- andreas

-- 
Andreas Schneider                   GPG-ID: F33E3FC6
Samba Team                             asn at samba.org
www.samba.org