[gentoo-dev] Re: Improve the security of the default profile

[Ryan Hill]

On Sat, 7 Sep 2013 18:10:42 +0000 (UTC)
Martin Vaeth <vaeth@××××××××××××××××××××××××.de> wrote:

> Ryan Hill <dirtyepic@g.o> wrote:
> >
> > * -fstack-protector{-all}
> > No thank you.  -fstack-protector has very limited coverage
>
> I'd say it covers most cases where bugs can be made,
> practically without a severe impact on execution time or code size.

The numbers I've seen show a maximum of 5% coverage for code that has a large
number of functions containing char arrays on the stack.  Most code doesn't fall
into that category.  Coverage of perl was 0.5%, xorg 5%, kernel 3%.  Those are
really old numbers though.  The most recent I've seen is Chromium's coverage is
<2%.  There is an upper bound of 8% performance overhead using -fstack-protector
according to the design spec.  If you guys are okay with that then we can try
enabling it for 4.8.1.

> > * -Wl,-z,relro
> > Enabled by default since binutils 2.18
>
> This gives its real impact on secutiry only when combined with
>
> * -Wl,-z,now
>
> The latter is not enabled by default AFAIK.

That's a bit misleading.  Immediate binding does allow the GOT to be made
readonly but relro does a lot more than that.  In any case this is a firm no.
The increase in loading times for apps that link lots of libraries is
significant (if it wasn't, we wouldn't need lazy loading :p).  If you want full
relro, enable it yourself or use hardened.

> I would like to suggest also another flag
>
> * -Wl,-z,noexecstack
>
> This should be the default, but e.g. some broken gcc versions
> forgot this default when using -flto.
> I am using this flag since I realized this -flto bug and never
> had any problems with it.

Well, portage will already tell you if your package installed any binaries with
executable stacks and I don't see many of those warnings that aren't binary
packages so I think we're good.

>
> > * -Wl,--hash-style={both,gnu}
>
> I don't know what this has to do with security.

I'm just responding to the list on the Ubuntu page.

> However, isn't it time to use "gnu" now for all users?  Except for
> very strange binary-only code it should not cause any problems.
> The majority of users would not realize a difference but profit
> from smaller binaries.

Sure, but the sysv hash is teeny and backward compatibility is always nice if
it's next to free.

Here are some more resources if anyone is interested:

https://wiki.debian.org/Hardening
https://bugs.archlinux.org/task/18864
https://wiki.gentoo.org/wiki/Project:Hardened/GNU_stack_quickstart
http://tk-blog.blogspot.ca/2009/02/relro-not-so-well-known-memory.html

-- 
Ryan Hill                        psn: dirtyepic_sk
   gcc-porting/toolchain/wxwidgets @ gentoo.org

47C3 6D62 4864 0E49 8E9E  7F92 ED38 BD49 957A 8463