Re: [gentoo-dev] Stack smash protected daemons

[Ned Ludd]

On Thu, 2004-09-23 at 15:03, Mike Frysinger wrote:
> On Thursday 23 September 2004 10:47 am, Marius Mauch wrote:
> > On 09/22/04  Mike Frysinger wrote:
> > > On Wednesday 22 September 2004 08:42 pm, Ciaran McCreesh wrote:
> > > > Or, as a FEATURE, it can be easily enabled. Just like it can be as a
> > > > CFLAG.
> > >
> > > well, considering we keep getting shot down for per-package CFLAGS,
> > > that's really not an option
> > > -mike
> >
> > You don't have per-package FEATURES either, so that's pointless.
>
> no it's not ... you can check $FEATURES in each package for autossp ...



> but by
> the same token we could check $USE too

agreed

USE is a lot easier to use and I feel is more readable logic wise in
ebuilds and would have the advantage of us actually seeing what packages
has been fixed via -pv (without having to keep greping the whole darn
tree)

But the disadvantage here is that we have to explicitly add said USE
flag to the profiles (which you know a certain somebody might come right
in and disable it) unless we rename said flag/feature (cuz you don't
want "no"flags) to something like USE=idiot then the logic in ebuilds
could work as. use idiot || append-flags -fstack-protector 
Or perhaps even following in the footsteps of x11-base/xorg which has
"insecure-drivers" but maybe using the name "insecure-cflags"

But how we get there does not matter so much to me as the end result is
what counts.

> -mike
>
> --
> gentoo-dev@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer