Gentoo Archives: gentoo-dev

From: Ryan Hill <dirtyepic@g.o>
To: gentoo-dev@l.g.o
Subject: [gentoo-dev] Re: Improve the security of the default profile
Date: Wed, 11 Sep 2013 05:57:20
Message-Id: 20130911000729.46cda29c@caribou.gateway.2wire.net
In Reply to: Re: [gentoo-dev] Re: Improve the security of the default profile by Richard Yao
1 On Tue, 10 Sep 2013 18:41:34 -0400
2 Richard Yao <ryao@g.o> wrote:
3
4 > A few thoughts:
5 >
6 > 1. The kernel expects -fno-stack-protector to be the default. What will
7 > the effect be on kernel configuration once -fstack-protector is the default?
8
9 The kernel has supported building with -fstack-protector since 2.6.19, (at least
10 on x86/x86-64). It's controlled by CONFIG_CC_STACKPROTECTOR and if it's
11 disabled then -fno-stack-protector is explicitly added to the command line.
12
13 > 2. We should make sure that -fno-stack-protector is a supported CFLAG.
14 > This will make it easier to handle complaints from the vocal minority of
15 > our user base that want every last percentage point of performance.
16
17 If by supported you mean that they won't be removed by things like strip-flags,
18 then yes, -fstack-protector -fstack-protector-all -fno-stack-protector and
19 -fno-stack-protector-all are all on the whitelist.
20
21 > 3. I would like to point out that we are talking about deviating from
22 > upstream behavior and everyone is okay with it. Anyone who thinks we
23 > should stick to upstream when it is not good for us should speak now or
24 > risk being asked "where were you when..." whenever they try to use
25 > upstream as an excuse to hold back progress. ;)
26
27 In this case it seems every other distro is already doing this, so we're in
28 good company.
29
30
31 --
32 Ryan Hill psn: dirtyepic_sk
33 gcc-porting/toolchain/wxwidgets @ gentoo.org
34
35 47C3 6D62 4864 0E49 8E9E 7F92 ED38 BD49 957A 8463

Attachments

File name MIME type
signature.asc application/pgp-signature

Replies