1 |
On Sun, 6 Aug 2006, Ned Ludd wrote: |
2 |
|
3 |
> On Sun, 2006-08-06 at 13:17 +0200, Peter S. Mazinger wrote: |
4 |
> > On Mon, 31 Jul 2006, Ned Ludd wrote: |
5 |
> > |
6 |
> > > On Mon, 2006-07-31 at 20:33 +0200, pageexec@××××××××.hu wrote: |
7 |
> > > > On 31 Jul 2006 at 11:28, Ned Ludd wrote: |
8 |
> > > > > gcc-4.x and hardened are not in the works.. |
9 |
> > > > > We are undecided at this time how much we wish to pursue that avenue. |
10 |
> > > > |
11 |
> > > > which part of hardened gcc is in question? i'd think that at least |
12 |
> > > > PIE/RELRO/BIND_NOW are as easy to support as in 3.x. |
13 |
> > > |
14 |
> > > Yes these would be pretty trivial to do. |
15 |
> > > |
16 |
> > > > ssp may or may |
17 |
> > > > not be a good idea given how new the 4.x series is, but as Mike said, |
18 |
> > > > at least there's an eager upstream to fix any issues. |
19 |
> > |
20 |
> > toolchain.eclass misses the needed support for gcc-4.1 like ssp |
21 |
> > |
22 |
> > > I think the major problem we are facing here is how to cleanly upgrade |
23 |
> > > from 3.x to 4.x. symbol names have changed. And using the stub/aliases |
24 |
> > > method Peter used in uClibc svn allows the __guard to be overwritten. |
25 |
> > |
26 |
> > How can __guard be overwritten, it is even marked with attribute_relro? |
27 |
> |
28 |
> We tested and talked about this before peter.. |
29 |
> None the less here is a simple testcase for you. |
30 |
> |
31 |
> extern unsigned long __guard; |
32 |
> |
33 |
> void fail() { |
34 |
> __guard = 0; |
35 |
> } |
36 |
> |
37 |
> int main() { |
38 |
> puts("This should fail"); |
39 |
> fail(); |
40 |
> puts("This should not be reached"); |
41 |
> return 0; |
42 |
> } |
43 |
> |
44 |
> |
45 |
> ./guardtest |
46 |
> This should fail |
47 |
> main: stack smashing attack in function fail() |
48 |
> Aborted |
49 |
> |
50 |
> You results should be similar. |
51 |
|
52 |
No, it works for me correctly/securely |
53 |
|
54 |
Peter |
55 |
|
56 |
-- |
57 |
Peter S. Mazinger <ps dot m at gmx dot net> ID: 0xA5F059F2 |
58 |
Key fingerprint = 92A4 31E1 56BC 3D5A 2D08 BB6E C389 975E A5F0 59F2 |
59 |
|
60 |
-- |
61 |
gentoo-hardened@g.o mailing list |