| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA1 |
| 3 |
|
| 4 |
On 01/09/2014 06:09 PM, Anthony G. Basile wrote: |
| 5 |
> On 01/09/2014 05:29 PM, Rick "Zero_Chaos" Farina wrote: |
| 6 |
>> -----BEGIN PGP SIGNED MESSAGE----- |
| 7 |
>> Hash: SHA1 |
| 8 |
>> |
| 9 |
>> On 01/09/2014 05:21 PM, Michał Górny wrote: |
| 10 |
>>> Dnia 2014-01-09, o godz. 17:06:52 |
| 11 |
>>> "Anthony G. Basile" <blueness@g.o> napisał(a): |
| 12 |
>>> |
| 13 |
>>>> On 01/09/2014 04:57 PM, Pacho Ramos wrote: |
| 14 |
>>>>> What are the advantages of disabling SSP to deserve that "special" |
| 15 |
>>>>> handling via USE flag or easily disabling it appending the flag? |
| 16 |
>>>> There are some cases where ssp could break things. I know of once case |
| 17 |
>>>> right now, but its somewhat exotic. Also, sometimes we *want* to break |
| 18 |
>>>> things for testing. I'm thinking here of instance where we want to |
| 19 |
>>>> test |
| 20 |
>>>> a pax hardened kernel to see if it catches abuses of memory which would |
| 21 |
>>>> otherwise be caught by executables emitted from a hardened toolchain. |
| 22 |
>>>> Take a look at the app-admin/paxtest suite. |
| 23 |
>>> Just to be clear, are we talking about potential system-wide breakage |
| 24 |
>>> or single, specific packages being broken by SSP? In other words, are |
| 25 |
>>> there cases when people will really want to disable SSP completely? |
| 26 |
>>> |
| 27 |
>>> Unless I'm misunderstanding something, your examples sound like you |
| 28 |
>>> just want -fno-stack-protector per-package. I don't really think you |
| 29 |
>>> actually want to rebuild whole gcc just to do some testing on a single |
| 30 |
>>> package... |
| 31 |
>>> |
| 32 |
>> Or just as easily set -fno-stack-protector in CFLAGS in make.conf. |
| 33 |
>> |
| 34 |
> |
| 35 |
> I just reread this and we'd better be clear here. With ssp on by |
| 36 |
> default in gcc, if you put CFLAGS="... -fno-stack-protector" in |
| 37 |
> make.conf you will build your *entire* system with no ssp. You probably |
| 38 |
> don't want this. You'll probably only want ssp off on a per package |
| 39 |
> basis, in which case, add a line to package.env and set the CFLAGS for |
| 40 |
> only that package. |
| 41 |
> |
| 42 |
Of course this is EXACTLY the same as building gcc[nossp] which is what |
| 43 |
we are discussing. So afaict you and I are in total agreement on all fronts. |
| 44 |
|
| 45 |
- -Zero |
| 46 |
-----BEGIN PGP SIGNATURE----- |
| 47 |
Version: GnuPG v2.0.22 (GNU/Linux) |
| 48 |
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ |
| 49 |
|
| 50 |
iQIcBAEBAgAGBQJSzy6AAAoJEKXdFCfdEflKOY0P/2dfvjVAFTq9NyZqMgJe0j1/ |
| 51 |
sENGtTCAAxKWh3eoqPywDJpEarPYoIsctMUGbuM2Dx6kC1zv20klXiT9Oec5j8aG |
| 52 |
qnAogeCubAQD/AjDLI5VjDU5dAH7xUEEQKWPEEdjqfV1xWstW91f+tfPg2JkxpMS |
| 53 |
zeQtSAIhJJMRdcFXmmWIvbh8zAUczdxsEcdGBHSt97utbMnbJMOE1eGEWGqAfzWm |
| 54 |
vFYLnA8R/TZO//wkbkqNTAQjL3JV8DKScaqVyFxh5wQhTCLMN4QFVqnlSJGDiZPS |
| 55 |
bddylShRtMXXsqPmFmLIsFf9tY7N03+2U8Ex3l1ToEpBATK6kkwBtuVCv0tOPvp8 |
| 56 |
EYOOXjmHZSmsG37SUFMgZpsAfNCf6H030G1i9NEC2zOnW5i9vHWmL1rAVpVYGdu2 |
| 57 |
N3rW2QYPEQzIBjNOojsXp515okIzPt8biXcWGT1R+te2BUoEeNwLNco9zCJecL1H |
| 58 |
YZNSmmA0fwc/vgvKOh1kfV4VAFwmM/cHAlI7UPG9ypM6Fo/3dn7zZgUaXdQU2KeL |
| 59 |
g+UNaFDj2p8ob+2vIc5N0lNwSNgY/vms2DehXRAV52vwogxNBgTftJZwwQv+j25u |
| 60 |
g1JWGf/MOXbh7mfDDK5Xr10fHEui6hpeSofC3BZC8pQ6k1duB1rKituWhBzBJBPF |
| 61 |
w8AeXL74ZvsUwwUxwi4A |
| 62 |
=AtZz |
| 63 |
-----END PGP SIGNATURE----- |
Archives