Did you look here? grsecurity.net/~paxguy1/pax-…

That's a kernel patch and not the GCC plugin that does the analysis / adds the instrumentation.

The plugin is in the kernel patch (just like other Linux plugins). Check inside: linux-4.9.24/scripts/gcc-plugins/rap_plugin

Hm, interesting. As soon as I get a real version with a little bit of documentation to test, I'll look into it. Extracting files from a partial patch is not how I usually evaluate other prototypes

Hm, there is no config option to build the RAP plugin. This is advanced software archaeology where I reverse engineer a plugin that is hidden in a partial kernel patch without any form of documentation. This software would fail any artifact evaluation.

To be fair, anything out of mainline Linux kernel is a horrific maintenance tire fire *by design*, it's how the system gets things polished into the mainline kernel.

Like, yes, this is bullshit, but it's *normalized* bullshit on a much larger scale than this one plugin.

My point is that @paxteam has no basis or justification to yell at academics for not evaluating RAP if it simply cannot be evaluated reasonably.

I'm confused. GCC plugins for the Linux kernel are delivered in the gcc script directory. That's true for mainline and really anyone else. There is a FAQ which is complete enough and not over verbose. The whole kernel is a better evaluation than a toy source code.

Please tell me how I can evaluate the RAP plugin on a small user-space case study that will allow me to test the analysis and power of the defense.