| 1 |
basile schrieb: |
| 2 |
> Mansour Moufid wrote: |
| 3 |
>> On Sun, Apr 19, 2009 at 9:44 AM, Thomas Sachau <tommy@g.o> wrote: |
| 4 |
>> |
| 5 |
>>> basile schrieb: |
| 6 |
>>> |
| 7 |
>>>> Hi, a have a couple of question is for Gordon and Nedd regarding |
| 8 |
>>>> rebuilding an entire desktop system with emerge -e world, both amd64 |
| 9 |
>>>> and |
| 10 |
>>>> i686. I'm mostly worried about the security implications of the |
| 11 |
>>>> choices I'm making and I'm not 100% sure of my understanding. |
| 12 |
>>>> |
| 13 |
>>>> 1) Regarding choice of compiler. gcc-config -l gives |
| 14 |
>>>> |
| 15 |
>>>> [1] x86_64-pc-linux-gnu-3.4.6 |
| 16 |
>>>> [2] x86_64-pc-linux-gnu-3.4.6-hardenednopie |
| 17 |
>>>> [3] x86_64-pc-linux-gnu-3.4.6-hardenednopiessp |
| 18 |
>>>> [4] x86_64-pc-linux-gnu-3.4.6-hardenednossp |
| 19 |
>>>> [5] x86_64-pc-linux-gnu-3.4.6-vanilla |
| 20 |
>>>> [6] x86_64-pc-linux-gnu-4.1.2 |
| 21 |
>>>> |
| 22 |
>>>> My understanding is that [1] is fully hardened and that [2]-[5] are |
| 23 |
>>>> exactly what they say, respectively no pie, no pie nor ssp, no ssp and |
| 24 |
>>>> fully vanilla. My confusion is about 4.1.2. What hardening is present |
| 25 |
>>>> in it? (Did some hardening which wasn't present in gcc-3 make it to |
| 26 |
>>>> gcc-4 vanilla?) What's the best practice here? |
| 27 |
>>>> |
| 28 |
>>> You are right with gcc-3.4.6-r2. How did you install gcc-4? It should |
| 29 |
>>> be masked as that version does |
| 30 |
>>> not have any builtin hardened features, so is only a normal, |
| 31 |
>>> none-hardened gcc-4.1.2 |
| 32 |
>>> |
| 33 |
>> |
| 34 |
>> This can happen when using a non-hardened stage3 tarball during the |
| 35 |
>> install, then switching to the hardened profile later. |
| 36 |
>> |
| 37 |
>> I've noticed it's not immediately clear where to get hardened stages |
| 38 |
>> in the documentation. For those wondering, the mirror URL can be found |
| 39 |
>> in the topic on #gentoo-hardened, i.e.: |
| 40 |
>> http://gentoo.osuosl.org/releases/${ARCH}/2008.0/stages/hardened/ |
| 41 |
>> |
| 42 |
>> |
| 43 |
> |
| 44 |
> I followed a variation of the upgrade process discussed here: |
| 45 |
> |
| 46 |
> http://www.gentoo.org/proj/en/hardened/toolchain-upgrade-guide.xml |
| 47 |
> |
| 48 |
> The differences are I used binutils-2.18 and glibc-2.8_p20080602-r1 |
| 49 |
> |
| 50 |
> I understand that its a VERY EARLY draft, but it proceeded without any |
| 51 |
> problems on both i686 and amd64. I'm pretty sure I didn't loose PIE, |
| 52 |
> but I'm not so sure about SSP. I'm playing around now with |
| 53 |
> -fstack-protector-all in my CFLAGS. |
| 54 |
> |
| 55 |
> |
| 56 |
>>>> 2) Regarding the choice of profiles on amd64. I have |
| 57 |
>>>> |
| 58 |
>>>> [6] hardened/amd64 |
| 59 |
>>>> [7] hardened/amd64/multilib * |
| 60 |
>>>> [10] hardened/linux/amd64 |
| 61 |
>>>> |
| 62 |
>>>> I'm using the multilib and I'm wondering what the security implications |
| 63 |
>>>> of this decision. Also, should I be thinking about the newer [10] on |
| 64 |
>>>> amd64? What about the similar choice on i686? |
| 65 |
>>>> |
| 66 |
>>>> Thanks guys. |
| 67 |
>>>> |
| 68 |
>>>> |
| 69 |
>>> What security implications should be there? |
| 70 |
>>> The newer [10] is still experimental and may change without warning. |
| 71 |
>>> Use either [6] or [7] for now. |
| 72 |
>>> |
| 73 |
>>> -- |
| 74 |
>>> Thomas Sachau |
| 75 |
>>> |
| 76 |
>>> Gentoo Linux Developer |
| 77 |
>>> |
| 78 |
>>> |
| 79 |
> I remember reading about lots of security bugs with emulating |
| 80 |
> libraries. I just googled for it to remind myself. So I'm wondering |
| 81 |
> whether profile 6 is better than 7. |
| 82 |
|
| 83 |
There may be open bugs with those emul-linux-* packages which currently provide some basic 32bit |
| 84 |
libs, but they are not installed by using the profile nor are you forced to use them. If your |
| 85 |
reading was about something different, please specify it. |
| 86 |
|
| 87 |
|
| 88 |
-- |
| 89 |
Thomas Sachau |
| 90 |
|
| 91 |
Gentoo Linux Developer |
Archives