Why "ulimit -s unlimited" can de-ASLR in overflow?

Question

I know the ulimit -s unlimited trick (to fix the address of libc) but i dont understand the fact behind,anyone could help me to make a explanation?~ thx

Answer 1

Accoding to the bash manual page

ulimit provides control over the resources available to the shell and to processes started by it, on systems that allow such control.

The -s flag define the maximum stack size.

So ulimit -s unlimited removes the maximum limit of the stack size and this enable the legacy mmap function.

According to Hexcellent

On 32 bit systems “ulimit -s unlimited” disables the randomization of the mmap()-ing because of the following code in the kernel at arch/x86/mm/mmap.c:

static int mmap_is_legacy(void)
{
    if (current->personality & ADDR_COMPAT_LAYOUT)
            return 1;

    if (rlimit(RLIMIT_STACK) == RLIM_INFINITY)
            return 1;

    return sysctl_legacy_va_layout;
}