Re: [gentoo-dev] Stack smash protected daemons

[Ned Ludd]

On Wed, 2004-09-22 at 11:54, John Richard Moser wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> It may be prudent to use extra protection on certain ebuilds in standard
> Gentoo profiles where the changes would be significant in the case of a
> security fault in the program.  Such programs as daemons and chmod()+s
> programs would be major targets for this sort of thing.
>
> The most immediately apparent route to take would be to have ebuilds
> such as openssh, apache, and su stack smash protected.  This would
> prevent common buffer overflow attacks from being used to compromise
> security; such attacks would only cause the program attacked to abort,
> which could still be used as a Denial of Service attack, but would not
> allow successful intrusion.
>
> Gentoo ships gcc with stack smash protection built in.  This is
> activated by -fstack-protector or -fstack-protector-all.  It would be
> feasible to add one of these flags to an ebuild based on a FEATURES or
> USE setting.
>
> I believe it would be a good idea to have such a FEATURES or USE flag on
> by default in all profiles where SSP is supported.  In this manner, the
> major targets of security attacks would automatically be protected;
> while still allowing the user to disable the protection if the user
> desires.  Users wanting more protection can simply add -fstack-protector
> to CFLAGS, or use Hardened Gentoo.
>
> Any comments?  Would this be more suitable as a USE or a FEATURES setting?


This would indeed significantly reduce impact of many existing security
problems that could potentially introduce and execute arbitrary code.

Yes this makes complete and total sense in the terms of what your saying
here. Vs using hardened which is not ideal for everybody or all
occasions(due to the other things it enables by default) to limit the
use of -fstack-protector to/for setuid/setgid and services only.

I fully support this idea for atleast all base system packages that fall
under the conditions you have defined, and assuming to many trolls don't
come out of the woodwork I would be willing start on it if you can make
a detailed list.

As far as a disable feature how about FEATURES="noautossp" ?

>
> - --
> All content of all messages exchanged herein are left in the
> Public Domain, unless otherwise explicitly stated.
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.6 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBUaBOhDd4aOud5P8RAv/sAKCGx+cy5D3U35jDvGEFV5fcInF2fwCfbvGM
> QvF8iaV8fuNFVQcintwy+2o=
> =4Gdc
> -----END PGP SIGNATURE-----
>
> --
> gentoo-dev@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer