Gentoo Archives: gentoo-dev

From: Rumen Yotov <rumen_yotov@×××.bg>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] Stack smash protected daemons
Date: Wed, 22 Sep 2004 16:49:09
Message-Id: 1095871712.11301.16.camel@mymach.qrypto.org
In Reply to: [gentoo-dev] Stack smash protected daemons by John Richard Moser
1 On ср, 2004-09-22 at 18:54, John Richard Moser wrote:
2 > -----BEGIN PGP SIGNED MESSAGE-----
3 > Hash: SHA1
4 >
5 > It may be prudent to use extra protection on certain ebuilds in standard
6 > Gentoo profiles where the changes would be significant in the case of a
7 > security fault in the program. Such programs as daemons and chmod()+s
8 > programs would be major targets for this sort of thing.
9 >
10 > The most immediately apparent route to take would be to have ebuilds
11 > such as openssh, apache, and su stack smash protected. This would
12 > prevent common buffer overflow attacks from being used to compromise
13 > security; such attacks would only cause the program attacked to abort,
14 > which could still be used as a Denial of Service attack, but would not
15 > allow successful intrusion.
16 >
17 > Gentoo ships gcc with stack smash protection built in. This is
18 > activated by -fstack-protector or -fstack-protector-all. It would be
19 > feasible to add one of these flags to an ebuild based on a FEATURES or
20 > USE setting.
21 >
22 > I believe it would be a good idea to have such a FEATURES or USE flag on
23 > by default in all profiles where SSP is supported. In this manner, the
24 > major targets of security attacks would automatically be protected;
25 > while still allowing the user to disable the protection if the user
26 > desires. Users wanting more protection can simply add -fstack-protector
27 > to CFLAGS, or use Hardened Gentoo.
28 >
29 > Any comments? Would this be more suitable as a USE or a FEATURES setting?
30 >
31 > - --
32 > All content of all messages exchanged herein are left in the
33 > Public Domain, unless otherwise explicitly stated.
34 >
35 > -----BEGIN PGP SIGNATURE-----
36 > Version: GnuPG v1.2.6 (GNU/Linux)
37 > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
38 >
39 > iD8DBQFBUaBOhDd4aOud5P8RAv/sAKCGx+cy5D3U35jDvGEFV5fcInF2fwCfbvGM
40 > QvF8iaV8fuNFVQcintwy+2o=
41 > =4Gdc
42 > -----END PGP SIGNATURE-----
43 >
44 > --
45 > gentoo-dev@g.o mailing list
46 >
47 Hi,
48 You could use the 'hardened' USE-flag, but beside SSP (-fstack-protector
49 CFLAG) it also adds PIC/PIE and hardened-GCC, which IMO includes
50 modified GCC-spec to get PIC/PIE plus -fstack-protector.
51 Maybe there should be a new USE-flag (ssp) to get only part of hardened
52 protection.
53 There already exist ebuilds (php) which have hardened USE-flag. Think
54 this is such an example as PHP is very widely used (so attacked).
55 i think implementing only SSP will be a lot easier than all hardened.
56 Just want to mention that i use hardened for a year and have relatively
57 few error and bugs due to using hardened.
58 Now running hardened-2.6.7-r8 with SSP, full PaX (and quite full grsec2)
59 with working Xorg-6.8.0-r1 and nvidia-kernel binary module. Desktop home
60 system.
61 Thanks
62 Rumen

Attachments

File name MIME type
signature.asc application/pgp-signature