1 |
On ср, 2004-09-22 at 18:54, John Richard Moser wrote: |
2 |
> -----BEGIN PGP SIGNED MESSAGE----- |
3 |
> Hash: SHA1 |
4 |
> |
5 |
> It may be prudent to use extra protection on certain ebuilds in standard |
6 |
> Gentoo profiles where the changes would be significant in the case of a |
7 |
> security fault in the program. Such programs as daemons and chmod()+s |
8 |
> programs would be major targets for this sort of thing. |
9 |
> |
10 |
> The most immediately apparent route to take would be to have ebuilds |
11 |
> such as openssh, apache, and su stack smash protected. This would |
12 |
> prevent common buffer overflow attacks from being used to compromise |
13 |
> security; such attacks would only cause the program attacked to abort, |
14 |
> which could still be used as a Denial of Service attack, but would not |
15 |
> allow successful intrusion. |
16 |
> |
17 |
> Gentoo ships gcc with stack smash protection built in. This is |
18 |
> activated by -fstack-protector or -fstack-protector-all. It would be |
19 |
> feasible to add one of these flags to an ebuild based on a FEATURES or |
20 |
> USE setting. |
21 |
> |
22 |
> I believe it would be a good idea to have such a FEATURES or USE flag on |
23 |
> by default in all profiles where SSP is supported. In this manner, the |
24 |
> major targets of security attacks would automatically be protected; |
25 |
> while still allowing the user to disable the protection if the user |
26 |
> desires. Users wanting more protection can simply add -fstack-protector |
27 |
> to CFLAGS, or use Hardened Gentoo. |
28 |
> |
29 |
> Any comments? Would this be more suitable as a USE or a FEATURES setting? |
30 |
> |
31 |
> - -- |
32 |
> All content of all messages exchanged herein are left in the |
33 |
> Public Domain, unless otherwise explicitly stated. |
34 |
> |
35 |
> -----BEGIN PGP SIGNATURE----- |
36 |
> Version: GnuPG v1.2.6 (GNU/Linux) |
37 |
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org |
38 |
> |
39 |
> iD8DBQFBUaBOhDd4aOud5P8RAv/sAKCGx+cy5D3U35jDvGEFV5fcInF2fwCfbvGM |
40 |
> QvF8iaV8fuNFVQcintwy+2o= |
41 |
> =4Gdc |
42 |
> -----END PGP SIGNATURE----- |
43 |
> |
44 |
> -- |
45 |
> gentoo-dev@g.o mailing list |
46 |
> |
47 |
Hi, |
48 |
You could use the 'hardened' USE-flag, but beside SSP (-fstack-protector |
49 |
CFLAG) it also adds PIC/PIE and hardened-GCC, which IMO includes |
50 |
modified GCC-spec to get PIC/PIE plus -fstack-protector. |
51 |
Maybe there should be a new USE-flag (ssp) to get only part of hardened |
52 |
protection. |
53 |
There already exist ebuilds (php) which have hardened USE-flag. Think |
54 |
this is such an example as PHP is very widely used (so attacked). |
55 |
i think implementing only SSP will be a lot easier than all hardened. |
56 |
Just want to mention that i use hardened for a year and have relatively |
57 |
few error and bugs due to using hardened. |
58 |
Now running hardened-2.6.7-r8 with SSP, full PaX (and quite full grsec2) |
59 |
with working Xorg-6.8.0-r1 and nvidia-kernel binary module. Desktop home |
60 |
system. |
61 |
Thanks |
62 |
Rumen |