RunSafe Portal

RUNSAFE

CODE

Deployment Guide How it Works

Step 1

Select Install Method

Choose which install method you would like to see instructions for. Debs work for any debian-based OS such as Debian, Ubuntu, and Mint. RPMS work for any Fedora-based OS such as Fedora, centOS, RHEL, and Rocky Linux.

Step 2

Select Distribution

Need to know your distribution? Run this command in a terminal: lsb_release -a. The displayed Release will start with its major release number and/or the Codename will match one of those in parentheses in the dropdown if Code supports it.

Step 3

Install Code

1# Install packages to enable secure download of alkemist-lfr
2sudo apt-get update && sudo apt-get -y install apt-transport-https ca-certificates wget gnupg
3
4# Add RunSafe repo to list of those apt will check for packages
5echo 'deb https://runsafesecurity.jfrog.io/artifactory/debian-alkemist-lfr bullseye main' | sudo tee -a /etc/apt/sources.list.d/alkemist.list
6
7# Add RunSafe's GPG public key locally
8wget -qO - https://runsafesecurity.jfrog.io/artifactory/api/gpg/key/public | sudo apt-key add -
9
10# Update apt to include new repo and install alkemist-lfr
11sudo apt-get update
12sudo apt-get -y install alkemist-lfr
# Install packages to enable secure download of alkemist-lfr
sudo apt-get update && sudo apt-get -y install apt-transport-https ca-certificates wget gnupg

# Add RunSafe repo to list of those apt will check for packages
echo 'deb https://runsafesecurity.jfrog.io/artifactory/debian-alkemist-lfr bullseye main' | sudo tee -a /etc/apt/sources.list.d/alkemist.list

# Add RunSafe's GPG public key locally
wget -qO - https://runsafesecurity.jfrog.io/artifactory/api/gpg/key/public | sudo apt-key add -

# Update apt to include new repo and install alkemist-lfr
sudo apt-get update
sudo apt-get -y install alkemist-lfr

Run these commands on your system to let it know to look for Code's Load-time Function Randomization (LFR) packages on our servers and then install Code.

Step 4

Build with Code

1# RUNSAFE_LICENSE_KEY=<your license key> lfr-helper <your build command>
2
3# For example, to build the hello_world.c shown in the next tab you would run:
4sudo apt-get -y install gcc
5RUNSAFE_LICENSE_KEY=<insert RunSafe license here> lfr-helper gcc -o hello_world hello_world.c
# RUNSAFE_LICENSE_KEY=<your license key> lfr-helper <your build command>

# For example, to build the hello_world.c shown in the next tab you would run:
sudo apt-get -y install gcc
RUNSAFE_LICENSE_KEY=<insert RunSafe license here> lfr-helper gcc -o hello_world hello_world.c

Now that your system contains the files necessary for Code to run, prepend your build commands (make, gcc, g++, etc) with lfr-helper to automatically integrate Code into your existing build process.

The command shown will build the given hello_world.c into an Code-protected program called hello_world, but you can add lfr-helper to any build command, simple or complex.

Step 5

Verify Code Protection

1# Use ldd to see which libs have been included in the given binary
2# ldd <binary name> | grep lfr
3
4# For example, with the hello_world from the previous step
5ldd ./hello_world | grep lfr
6
7# This will return a line similar to the one below, but with a different memory address
8# $ liblfr.so => /usr/local/lib/liblfr.so (0x7f659d514000)
# Use ldd to see which libs have been included in the given binary
# ldd <binary name> | grep lfr

# For example, with the hello_world from the previous step
ldd ./hello_world | grep lfr

# This will return a line similar to the one below, but with a different memory address
# $ liblfr.so => /usr/local/lib/liblfr.so (0x7f659d514000)

Each tab shows a different way to confirm that Code has been applied to a given binary. The examples are for the hello_world binary built in the previous step.