1 |
On 01/09/2014 04:57 PM, Pacho Ramos wrote: |
2 |
> El jue, 09-01-2014 a las 21:58 +0100, Magnus Granberg escribió: |
3 |
>> Hi |
4 |
>> |
5 |
>> Some time ago we discussed that we should enable stack smashing |
6 |
>> (-fstack-protector) by default. So we opened a bug to track this [1]. |
7 |
>> The affected Gcc version will be 4.8.2 and newer. Only amd64, x86, mips, ppc, |
8 |
>> ppc64 and arm will be affected by this change. |
9 |
>> |
10 |
>> You can turn off ssp by using the nossp USE flag or by adding |
11 |
>> -fno-stack-protector to the CFLAGS and/or CXXFLAGS. We are using the same |
12 |
>> patch as Debian/Ubuntu but with some Gentoo fixes. |
13 |
>> |
14 |
>> The patch will move the sed for the HARD_CFLAGS, ALLCFLAGS and |
15 |
>> ALLCXXFLAGS from do_gcc_PIE_patches() to make_gcc_hard(). We will |
16 |
>> make_gcc_hard() the default for all Gcc versions 4.8 and newer, and turn |
17 |
>> it on or off with hardened_gcc_works() that will make some sanity checks. |
18 |
>> |
19 |
>> /Magnus |
20 |
> What are the advantages of disabling SSP to deserve that "special" |
21 |
> handling via USE flag or easily disabling it appending the flag? |
22 |
> |
23 |
> Thanks a lot for the info :) |
24 |
> |
25 |
> |
26 |
|
27 |
There are some cases where ssp could break things. I know of once case |
28 |
right now, but its somewhat exotic. Also, sometimes we *want* to break |
29 |
things for testing. I'm thinking here of instance where we want to test |
30 |
a pax hardened kernel to see if it catches abuses of memory which would |
31 |
otherwise be caught by executables emitted from a hardened toolchain. |
32 |
Take a look at the app-admin/paxtest suite. |
33 |
|
34 |
|
35 |
-- |
36 |
Anthony G. Basile, Ph.D. |
37 |
Gentoo Linux Developer [Hardened] |
38 |
E-Mail : blueness@g.o |
39 |
GnuPG FP : 1FED FAD9 D82C 52A5 3BAB DC79 9384 FA6E F52D 4BBA |
40 |
GnuPG ID : F52D4BBA |