RunSafe Portal

RUNSAFE

CODE

Deployment Guide How it Works

Step 1

Select Install Method

Choose which install method you would like to see instructions for. Debs work for any debian-based OS such as Debian, Ubuntu, and Mint. RPMS work for any Fedora-based OS such as Fedora, centOS, RHEL, and Rocky Linux.

Step 2

Select Distribution

Need to know your distribution? Run this command in a terminal: cat /etc/os-release. The displayed PRETTY_NAME will match one of those in the dropdown if Code supports it.

Step 3

Install Code

1# Add RunSafe repo to list of those apk will check for packages
2echo 'https://runsafesecurity.jfrog.io/artifactory/alpine-alkemist-lfr/3.16/main' >> /etc/apk/repositories
3
4# Add RunSafe's GPG public key locally
5wget -O /etc/apk/keys/alpine-alkemist-code.rsa.pub https://runsafesecurity.jfrog.io/artifactory/api/security/keypair/public/repositories/alpine-alkemist-lfr
6
7# Install alkemist-lfr
8apk add alkemist-lfr
# Add RunSafe repo to list of those apk will check for packages
echo 'https://runsafesecurity.jfrog.io/artifactory/alpine-alkemist-lfr/3.16/main' >> /etc/apk/repositories

# Add RunSafe's GPG public key locally
wget -O /etc/apk/keys/alpine-alkemist-code.rsa.pub https://runsafesecurity.jfrog.io/artifactory/api/security/keypair/public/repositories/alpine-alkemist-lfr

# Install alkemist-lfr
apk add alkemist-lfr

Run these commands on your system to let it know to look for Code's Load-time Function Randomization (LFR) packages on our servers and then install Code.

Step 4

Build with Code

1# RUNSAFE_LICENSE_KEY=<your license key> lfr-helper <your build command>
2
3# For example, to build the hello_world.c shown in the next tab you would run:
4sudo apk add build-base
5RUNSAFE_LICENSE_KEY=<insert RunSafe license here> lfr-helper gcc -o hello_world hello_world.c
# RUNSAFE_LICENSE_KEY=<your license key> lfr-helper <your build command>

# For example, to build the hello_world.c shown in the next tab you would run:
sudo apk add build-base
RUNSAFE_LICENSE_KEY=<insert RunSafe license here> lfr-helper gcc -o hello_world hello_world.c

Now that your system contains the files necessary for Code to run, prepend your build commands (make, gcc, g++, etc) with lfr-helper to automatically integrate Code into your existing build process.

The command shown will build the given hello_world.c into an Code-protected program called hello_world, but you can add lfr-helper to any build command, simple or complex.

Step 5

Verify Code Protection

1# Use ldd to see which libs have been included in the given binary
2# ldd <binary name> | grep lfr
3
4# For example, with the hello_world from the previous step
5ldd ./hello_world | grep lfr
6
7# This will return a line similar to the one below, but with a different memory address
8# $ liblfr.so => /usr/local/lib/liblfr.so (0x7f659d514000)
# Use ldd to see which libs have been included in the given binary
# ldd <binary name> | grep lfr

# For example, with the hello_world from the previous step
ldd ./hello_world | grep lfr

# This will return a line similar to the one below, but with a different memory address
# $ liblfr.so => /usr/local/lib/liblfr.so (0x7f659d514000)

Each tab shows a different way to confirm that Code has been applied to a given binary. The examples are for the hello_world binary built in the previous step.