RunSafe Portal

RUNSAFE

CODE

Deployment Guide How it Works

Step 1

Select Install Method

Choose which install method you would like to see instructions for. Debs work for any debian-based OS such as Debian, Ubuntu, and Mint. RPMS work for any Fedora-based OS such as Fedora, centOS, RHEL, and Rocky Linux.

Step 2

Select Distribution

Need to know your distribution? Run this command in a terminal: cat /etc/centos-release

Step 3

Install Code

1# Add RunSafe repo to list of those dnf will check for packages
2printf "[RunSafeSecurity-Code]
3name=RunSafeSecurity-Code
4baseurl=https://runsafesecurity.jfrog.io/artifactory/rpm-alkemist-lfr/8
5enabled=1
6gpgcheck=0
7gpgkey=https://runsafesecurity.jfrog.io/artifactory/rpm-alkemist-lfr/8/repodata/repomd.xml.key
8repo_gpgcheck=1" | sudo tee /etc/yum.repos.d/runsafesecurity-alkemist-lfr.repo > /dev/null
9
10# Install alkemist-lfr package
11sudo dnf -y install alkemist-lfr
# Add RunSafe repo to list of those dnf will check for packages
printf "[RunSafeSecurity-Code]
name=RunSafeSecurity-Code
baseurl=https://runsafesecurity.jfrog.io/artifactory/rpm-alkemist-lfr/8
enabled=1
gpgcheck=0
gpgkey=https://runsafesecurity.jfrog.io/artifactory/rpm-alkemist-lfr/8/repodata/repomd.xml.key
repo_gpgcheck=1" | sudo tee /etc/yum.repos.d/runsafesecurity-alkemist-lfr.repo > /dev/null

# Install alkemist-lfr package
sudo dnf -y install alkemist-lfr

Run these commands on your system to create the file /etc/yum.repos.d/runsafesecurity-alkemist-code.repo (which lets dnf know to look for Code's Load-time Function Randomization (LFR) packages on our servers) and then install Code.

Step 4

Build with Code

1# RUNSAFE_LICENSE_KEY=<your license key> lfr-helper <your build command>
2
3# For example, to build the hello_world.c shown in the next tab you would run:
4sudo apt-get -y install gcc
5RUNSAFE_LICENSE_KEY=<insert RunSafe license here> lfr-helper gcc -o hello_world hello_world.c
# RUNSAFE_LICENSE_KEY=<your license key> lfr-helper <your build command>

# For example, to build the hello_world.c shown in the next tab you would run:
sudo apt-get -y install gcc
RUNSAFE_LICENSE_KEY=<insert RunSafe license here> lfr-helper gcc -o hello_world hello_world.c

Now that your system contains the files necessary for Code to run, prepend your build commands (make, gcc, g++, etc) with lfr-helper to automatically integrate Code into your existing build process.

The command shown will build the given hello_world.c into an Code-protected program called hello_world, but you can add lfr-helper to any build command, simple or complex.

Step 5

Verify Code Protection

1# Use ldd to see which libs have been included in the given binary
2# ldd <binary name> | grep lfr
3
4# For example, with the hello_world from the previous step
5ldd ./hello_world | grep lfr
6
7# This will return a line similar to the one below, but with a different memory address
8# $ liblfr.so => /usr/local/lib/liblfr.so (0x7f659d514000)
# Use ldd to see which libs have been included in the given binary
# ldd <binary name> | grep lfr

# For example, with the hello_world from the previous step
ldd ./hello_world | grep lfr

# This will return a line similar to the one below, but with a different memory address
# $ liblfr.so => /usr/local/lib/liblfr.so (0x7f659d514000)

Each tab shows a different way to confirm that Code has been applied to a given binary. The examples are for the hello_world binary built in the previous step.