Re: [gentoo-dev] Stack smash protected daemons

[John Richard Moser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Stephen P. Becker wrote:
|> As someone who is passively absorbing this information, I find your
|> ignorance combined with your claim of being a security expert to
|> indicate that you're full of shit.
|>
|> You've repetedly referred to the issue of cross-platform portability
|> with SSP in here, for example; and I've pointed out once a link that
|> shows that SSP is OS and CPU independent.  Do your research, read what's
|> out there.
|>
|
| So are you then going to test it for us on mips then?  "I read it on the
|  internet so it must be true" is a *horrible* way to do QA.  Mozilla is
| also supposed to be arch neutral.  Guess what...it doesn't work on mips.
|  Oops!  We're a small arch in terms of both devs and users.  To my
| knowledge, a full SSP userland has *never* been tested on mips.  We are
| spread way to thin currently for such an endeavor.

OK so who has a mips you can test it on?

|
| So then, are you volunteering to build mips stages with SSP to prove
| that it works for certain?  We really don't have the manpower to do that
| currently.  Are you going to answer to any bug reports we would get if
| this is implemented?
|
| Also, in terms of "researching" this problem, do you realize you just
| told the Gentoo/sparc strategic manager that he doesn't know anything
| about his own arch?  "No! you're wrong! SSP does work on your arch!"

"And ssp is supposed to be portable.  Etoh and Yoda's paper[1] says that
The IBM stack smash protection method (ProPolice) is CPU and OS
independent[2].  I think that you'd be within reason to complain to them
if it didn't work accross all archs."

I never gave you my personal guarantee, I said based on research and on
what the maintainers say, it should; and that if it doesn't then it's
something they (not you) need to fix.  I do like to think that people
don't lie about their software, at the very least not intentionally.

Obviously if it breaks on X arch, you disable it there.

| Reminds me of arguments I've had with people that tried to tell me (I'm
| a geologist) the Earth is only 7000 years old because the bible says so.
|  I suggest you pull your head out of the collective x86 ass.  The
| non-x86 arch teams have enough breakage to deal with without introducing
| another layer of potential brokenness.

I was considering more than x86, else I'd have asked you why the hell it
needs to be cross-arch.  I use x86_64 mainly, although I guess that
counts as x86 huh?  (the amd64 caabal doesn't seem to agree :>)  In this
case the architectural similarities put them in the same class.

Still, I figured they meant "alpha sparc mips arm sh4 windows dos macos
aix unix linux" when they said CPU and OS independent.

|
| I still don't understand why we can't simply place a blurb in the
| install handbook as I suggested before.  It is always much easier to add
| something than take it away in this circumstance.  If a user *really*
| wants that functionality, they'll add it in.  If a user *really* doesn't
| want it, but it is on by default, they will have to rebuild their whole
| userland, which on machines such a those supported by the mips port
| would be *extremely* painful.
|

It's a design decision still.  If you supply a non-SSP userland in your
stages, the user has to start from stage 1 (not 2 or 3) to get SSP.  If
you supply an SSP userland in the stages, the user has to start from
stage 1 to remove it.  The hardened stages come with PIE-SSP, but what
if the user doesn't want a full hardened system (i.e. pie and the
hardened profile)?  Obviously you don't want to waste more space on the
mirrors supplying non-ssp/ssp/pie-ssp-selinux stages for each arch.

Why not take a poll of the user base, and ask if SSP should be on by
default or not?

| Steve
|
|

- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBVuvDhDd4aOud5P8RAm4uAJ94IoyZFByzemth5qcXvEWyfkffewCeNEid
jrcMbnuBmtJnBBZLA3l+4oU=
=H8GL
-----END PGP SIGNATURE-----

--
gentoo-dev@g.o mailing list