Re: [gentoo-hardened] Hardened gcc-4

[Ned Ludd]

On Fri, 2008-01-18 at 21:03 +0100, atoth@××××××××××.hu wrote:
> Hi Solar!
>
> Thank you for sharing all these valuable informations with us.
>
> --
> dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962
> Attila Toth MD, Radiologist in Training, [phone], [phone]
>
> On Pén, Január 18, 2008 08:16, Ned Ludd wrote:
> >
> > On Fri, 2008-01-18 at 04:46 +0100, atoth@××××××××××.hu wrote:
> >> On Csü, Január 17, 2008 20:57, Ned Ludd wrote:
> >> >
> >> > On Thu, 2008-01-17 at 20:03 +0100, atoth@××××××××××.hu wrote:
> >
> > [snip]
> >
> >> > Note: That both of the methods I have shown do not enable SSP in
> >> gcc-4.
> >> >
> >>
> >> Thanks for the suggestions.
> >> BTW: why don't you enable SSP? If
> >
> >
> >> I would spend my time on separate specs, I would surely go for SSP as
> >> well.
> >
> > You are more than welcome to edit the specs for yourself and add the
> > ssp rules as well. I'm not a big fan of moving forward with ssp myself
> > and pie/relro/now is cheap/easy suits most of my needs so why not take
> > advantage of it..
> >
> > If you want add ssp to those specs you can probably more or less base
> > them easy enough off the gcc-3.x specs.
> >
> > Should/Would look something nearly exactly like this
> [snip]
> >
> >> Are there any known problems?
> >
> > yes, but please don't ask me to document them for you.
> >
>
> I would never ever ask you for that...
>
> I would rather avoid tampering with eclass functions (using KQ overlay).
> As I can make it out: ssp is built into gcc version 4.1+ taken from the
> regular portage tree. KQ's version discards two patches, but applies a pie
> patch. KQ's glibc installs a handler and takes care of unsupported and
> supported archs.
>
> I'll follow your advice and create some specs for the system. I wonder if
> the spec files from KQ's overlay could be used along with current portage
> toolchain ebuilds (gcc-4.1.1-r3 or gcc-4.1.2 and glibc-2.6.1)? I'm worried
> about the pie patch missing...
>
> What is the reason you are not keen on ssp as a security-focused developer?


Sorry I should of clarified. What I'm keen on, is not talking about 
gcc-4.x at all. Really I posted the info here not just for you but for
others who might be looking/searching to do the same thing. More or less
so I would hopefully not have to be bugged about gcc-4.x again for
another 6months. I really don't like talking about it as it personally
frustrates me. You would have to search our archives here to see when I
let go of maintainer-ship of the hardened-toolchain for more details.

Good luck...


-- 
Ned Ludd <solar@g.o>
Gentoo Linux

-- 
gentoo-hardened@l.g.o mailing list