Re: [gentoo-hardened] Fwd: PaX, SSP, grsecurity, and whatnot

[Ned Ludd]

On Sun, 2004-02-15 at 19:06, Eric P. wrote:
> On Monday 16 February 2004 06:56 am, Ned Ludd wrote:
> > On Sun, 2004-02-15 at 13:07, Eric P. wrote:
> > > Hello, All:
> > >
> > > I'm emerge'ing a _new_ system and realized later that I *may* have made a
> > > mistake:
> > >
> > >   I added '-fstack-protector' to CFLAGS and began emerge'ing the
> > >   system without emerge'ing hardened-gcc first.
> > >
> > > According the the propolice.xml page, SSP has been included in gcc since
> > > 3.2.3-r1 so - it is my understanding that - the '-fstack-protector'
> > > should enhance the security of the system against buffer-overflows. But
> > > by not using hardened-gcc, I'm concerned that I may have missed-out on a
> > > critical security enhancement.
> >
> > You have.
> > But without a kernel to support it would do little good.
> >
> > >Should I re-emerge the entire system or just emerge hardened-gcc before
> > > emerge'ing grsec-sources?
> >
> > The kernel has been known not to play along with hgcc at times so
> > probably your best bet is building your kernel beforehand and then
> > merging hardened-gcc then finishing it off with an emerge -e world
>
> Thanks, Ned. I'm still a bit confused though: Without a kernel to support
> hardened-gcc, it doesn't do much to enhance security *but* when I compile a
> kernel I should disable hardened-gcc?
>
> The Handbook instructs to...
>
Which handbook? URL Please.

> 1. emerge system
> 2. emerge <kernel>
> 3. build the kernel

4. emerge hardened-gcc
5. Optionally remove -fstack-protector from CFLAGS
6. emerge -e world

>
> How should I integrate the hardened-gcc ebuild into this? Since SSP is already
> integrated into gcc-3.2.3-r1 I added "-fstack-protector" to CFLAGS before
> doing any of this.

gcc-3.3.2-r5 is stable now. We are encouraging users to update to this
version at this time.

>
> Eric P.
-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer