Re: [gentoo-hardened] Ports Security

[Jan Krueger]

On Friday 05 September 2003 18:02, Alexander Gabert wrote:
> yeah,
>
> we should think about source-parsing function pointer bounds checkers
> and formatstring checkers to round up our efforts in respect to the
> linear overflow protection provided by the propolice support (SSP) and
> the process randomization of dynamic PIC binaries by PaX.
>
> if you want we can discuss it in the channel #gentoo-hardened on
I prefer discussion here, because it is searchable/grepable afterwards.

> freenode what solutions are available currently and how hard it would be
> to update portage (similar approach like the antivirus scanning prep'd
> by solar some time ago)

So far i came to the conclusion that this should be a portage FEATURE,
with configuration option in make.conf, like which scans do i want, how deep 
or so, break ebuild or not, scanner options.
Like that:

after src_unpack(), if feature is set, portage scans the source code, informs 
the user and at the users will, depending on the scan-results, breaks the 
ebuild or continues.

than src_compile

after src_install the files in the image which is to transfer to the real 
filesystem, is, before the transfer scanned for other things, (viri, trojans, 
suids, whatever), reports the results and at the users will, depending on the 
scan-results, breaks the ebuild or continues.

I know about the following source code scanners, almost restricted to c and 
c++:
flawfinder, http://www.dwheeler.com/flawfinder/
splint, http://www.splint.org/
its4, http://www.cigital.com/its4/
rats, http://www.securesw.com/download_form_rats.htm

Anyway, is there a policy like http://www.openbsd.org/porting.html#Security?

Jan


--
gentoo-hardened@g.o mailing list