57 lines
No EOL
2.3 KiB
HTML
57 lines
No EOL
2.3 KiB
HTML
<html devsite><head>
|
||
<title>Android 1.5 至 4.1 中的安全增强功能</title>
|
||
<meta name="project_path" value="/_project.yaml"/>
|
||
<meta name="book_path" value="/_book.yaml"/>
|
||
</head>
|
||
<body>
|
||
<!--
|
||
Copyright 2017 The Android Open Source Project
|
||
|
||
Licensed under the Apache License, Version 2.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
You may obtain a copy of the License at
|
||
|
||
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
||
Unless required by applicable law or agreed to in writing, software
|
||
distributed under the License is distributed on an "AS IS" BASIS,
|
||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
-->
|
||
|
||
<p>Android 提供了一个多层安全模型，<a href="/security/index.html">Android 安全性概述</a>中对该模型进行了介绍。每个 Android 更新版本中都包含数十种用于保护用户的安全增强功能。以下是 Android 1.5 至 4.1 版中引入的一些安全增强功能：</p>
|
||
|
||
<dl>
|
||
<dt><strong>Android 1.5</strong></dt>
|
||
<dd><ul>
|
||
<li>ProPolice：旨在防止堆栈缓冲区溢出 (-fstack-protector)</li>
|
||
<li>safe_iop：旨在减少整数溢出</li>
|
||
<li>OpenBSD dlmalloc 的扩展程序：旨在防范 double free() 漏洞和连续块攻击。连续块攻击是利用堆损坏的常见攻击方式。</li>
|
||
<li>OpenBSD calloc：旨在防止在内存分配期间发生整数溢出</li>
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><strong>Android 2.3</strong></dt>
|
||
<dd><ul>
|
||
<li>格式化字符串漏洞防护功能 (-Wformat-security -Werror=format-security)</li>
|
||
<li>基于硬件的 No eXecute (NX)：旨在防止在堆栈和堆上执行代码</li>
|
||
<li>Linux mmap_min_addr：旨在降低空指针解引用提权风险（在 Android 4.1 中得到了进一步增强）</li>
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><strong>Android 4.0</strong></dt>
|
||
<dd>地址空间布局随机化 (ASLR)：旨在随机排列内存中的关键位置</dd>
|
||
|
||
<dt><strong>Android 4.1</strong></dt>
|
||
<dd><ul>
|
||
<li>PIE（位置无关可执行文件）支持</li>
|
||
<li>只读重定位/立即绑定 (-Wl,-z,relro -Wl,-z,now)</li>
|
||
<li>启用了 dmesg_restrict（避免内核地址泄露）</li>
|
||
<li>启用了 kptr_restrict（避免内核地址泄露）</li>
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
</body></html> |