Re: [gentoo-hardened] __guard and __stack_smash_handler transition from libgcc to libc

[Scott Taylor]

On Sun, 23 Nov 2003, Alexander Gabert wrote:

> hi Martin,
>
> sorry to disturb you but there has been a hot weekend with me sorting
> out the side effects of the glibc transition to guard symbols.
>
> As this is becoming a technical challenge, i will explain it because i
> am sure we are on the right path with
> http://bugs.gentoo.org/show_bug.cgi?id=25299 containing a gcc ebuild
> diff which can do it right if bootstrap.sh on stage1 installations goes
> for building gcc directly after glibc (seemant told me this is a simple
> change).
>
> If the existing glibc is to be found to have the functions and the
> object of propolice inserted, the ebuild needs to search for binaries
> containing references to the __guard@GCC Version symbol in the shared
> library libgcc.so before removing the object and the functions in the
> gcc libgcc.
>
<stuff removed>
>
> Please approve and submit my changes in
> http://dev.gentoo.org/~pappy/gentoo-x86/sys-devel/gcc/ to the
> appropriate ebuilds of gcc and report back any improvements you would
> like to see in the progress of this movement.

However brave, dangerous, foolish or whatever, I got a chance to adopt
this patch early, though it was on gcc 3.3.2-r2 as I'm running ~x86
here. I had run into the  issue of not being able to compile static
libs. Anyway, I ran the patch before the readelf sanity check  was
written.  It killed python on one machine, and restoring its binary got
that (and therefore, portage) back in action,  it was rather painless
aside from that. There were a handful of programs on each machine that
were linked to the _guard in libgcc. By that point, I already had the
patched gcc installed, so I recompiled the affected packages directly,
without taking the extra step of compiling them without
-fstack-protector which would now be required (and would've assured a
safer migration) for the gcc ebuild to allow the patch to apply. So
yeah, I was living on the edge there. But with what we learned from
that, I have a pretty good feeling about this patch. It solved other
compiling issues, and I've now got  the patched gcc-3.3.2-r2 on five
different machines here, all of which had been unable to finish an
emerge world due to some attempt at compiling a static library.

--
Scott Taylor - <scott@××××××××××××××××.net> 

"So here's a picture of reality: (picture of circle with lots of sqiggles in it) As we all know, reality is a mess."

  -- Larry Wall (Open Sources, 1999 O'Reilly and Associates)