Re: [gentoo-dev] Stack smash protected daemons

[Daniel Goller]

Ned Ludd wrote:

>First let me suggest some good reading on this topic.
>http://www.ida.liu.se/~johwi/research_publications/paper_ndss2003_john_wilander.pdf
>
>On Wed, 2004-09-22 at 20:27, Ciaran McCreesh wrote:
>
>
>>On Wed, 22 Sep 2004 20:11:54 -0400 Ned Ludd <solar@g.o> wrote:
>>| > Well then leave it turned off, but put a note about the availability
>>| > of the feature in the comments above FEATURES= in make.conf.
>>|
>>| With FEATURES="noautossp" the user would be free to disable it on
>>| their own accord but being a responsible distribution to the users and
>>| the computing world we would/should not.
>>
>>Personally, I would be *very* wary about giving our x86 users a 5%
>>performance hit
>>
>>
>
>Feel free to do some objective benchmarking.
>
>
>
>>just to enable a hack
>>
>>
>
>What's this hack your now speaking of frequently?
>
>

well for what it's worth im all for the on by default and disabled by 
<inserttobedeterminedmachanismhere> solution

>
>
>>which might protect you if your
>>app happens to be badly coded in a particular way...
>>
>>
>
>Exactly see http://glsa.gentoo.org
>
>
>
>>The option's there
>>for anyone that wants it, but turning it on by default probably isn't
>>wise...
>>
>>
>
>For suids and/or services that bind listening ports?
>No the option is not really there for something like this.
>
>Do we have proper per package cflags yet?
>Answer = No.
>
>Is Nick ever going to add it?
>Answer = No.
>
>Can it be done?
>Answer = Yes. but it's a bitch todo and atleast one portage dev want to
>take away that ability.
>
>
>

--
gentoo-dev@g.o mailing list