Gentoo Archives: gentoo-dev

From: Duncan <1i5t5.duncan@×××.net>
To: gentoo-dev@l.g.o
Subject: [gentoo-dev] Re: Moving more hardening features to default?
Date: Fri, 21 Oct 2011 15:27:07
Message-Id: pan.2011.10.21.15.25.54@cox.net
In Reply to: Re: [gentoo-dev] Re: Moving more hardening features to default? by Mike Frysinger
1 Mike Frysinger posted on Fri, 21 Oct 2011 08:13:22 -0400 as excerpted:
2
3 > On Thursday 20 October 2011 23:20:35 Duncan wrote:
4 >> Magnus G suggests possibly adding PIE to amd64, which is already PIC,
5 >
6 > this isn't quite right. amd64 shared objects (i.e. libraries) are PIC.
7 > the applications are not.
8
9 Thanks for the correction. I knew the library think but supposed that
10 was the difference between PIC/PIE, the E/executable for executables
11 only, the more generic C/code for the feature applied to shared objects.
12
13 Seems there's a bit more to it than that. Thanks again, I can look it up
14 now that I know to do so.
15
16 > usually these packages are multimedia related. like ffmpeg iirc. so i
17 > think the impact is much greater than your estimate here.
18
19 I figured mm, but also assumed strip-flags-like exceptions (probably
20 controlled via USE flag) for packages where the default was really
21 costly. But now that I think of it, implementing that as arch defaults
22 while allowing overrides isn't quite the simple matter it is for user-set
23 CFLAGS, etc, and strip-flags, etc.
24
25 I assume it can still be done, but am not in a position to estimate
26 whether it'd be worth the cost to implement.
27
28 >> What about x32, tho? Does it get PIC by default too
29 >
30 > x32 is same as x86_64 wrt PIC
31
32 Good to know. Thanks.
33
34 --
35 Duncan - List replies preferred. No HTML msgs.
36 "Every nonfree program has a lord, a master --
37 and if you use the program, he is your master." Richard Stallman

Replies

Subject Author
Re: [gentoo-dev] Re: Moving more hardening features to default? Magnus Granberg <zorry@g.o>