Re: [gentoo-hardened] pwdb+pam+propolice failure

[Alexander Gabert]

hi,

we had some issues with cracklib, pwdb and pam.
which will result in filter-flags for propolice on gentoo proper.
sorry for that.

but you can use sys-devel/hardened-gcc which will build these applications with etdyn
and propolice using a special weapon called a transparent -pie specs file.

HTH,

Alex

On Fri, Aug 08, 2003 at 01:01:46PM -0400, Ned Ludd wrote:
>
> Thank you for reporting this. A fix for this problem with pam & cracklib
> is being worked on right now by the hardened team. We will post
> something to the gentoo-hardened mailing list when this is ready.
>
>
> On Fri, 2003-08-08 at 12:27, security mailing lists wrote:
> > This was using the completely out of the box standard 1.4 release live
> > cd.  I didn't unmask anything at all,  just added stack protection to
> > make.conf.  This is an AthlonXP 2100 (MSI-KT3-Ultra2 w/512MB)Here are
> > some of the options from make.conf
> >
> > CHOST=i686-pc-linux-gnu
> > CFLAGS="-O3 -march=athlon-xp -fstack-protector -funroll-loops -pipe"
> >
> > Nothing unmasked or modified (ACCEPT_KEYWORDS commented out, etc) so
> > this was all standard packages (gcc-3.2.3-r1 and glibc-2.3.2-r1).
> >
> > I don't see anything on bugs.gentoo.com for problems with pam and stack
> > protection,  just wanted to make sure I wasn't missing something before
> > I submitted the bug.  The gentoo propolice project website says that
> > things should compile out of the box with the proper gcc/glibc used
> > above.
> >
> >
> >
> > > On Fri, 2003-08-08 at 10:02, Boyd Waters wrote:
> > > > security mailing lists wrote:
> > > > > When building a system from the ground up using stack protection,
> > > > > emerge system fails while building PAM.  It complains the pam pwdb
> > > > > module did not get built.
> > > > >
> > > > > If I rebuild pwdb without stack protection, though it compiled fine with
> > > > > it the first time,  I can then build pam with stack protection without
> > > > > any problems.
> > > > >
> > > > > This was using the base CD and the normal install process with just
> > > > > -fstack-protection added to /etc/make.conf before bootstrap (stage2)
> > > >
> > > >
> > > > Curious... I did not run into this problem, building a system from
> > > > ground up with GCC 3.3 --
> > > >
> > > > I have an ebuild for a gcc-3.3 that uses the ProPolice patch from last
> > > > week, which was a more-recent patch than the standard 3.3 that was in
> > > > portage -- but I see that this is now gcc-3.3-r1 as of 04-August.
> > > >
> > > > Have you searched http://bugs.gentoo.org for this situation? It sounds
> > > > like a good bug report to me! What type of processor are you using? What
> > > > gcc/propolice version?
> > > >
> > > > -- boyd
> > > >
> > > >
> >
> > --
> > gentoo-hardened@g.o mailing list
> --
> Ned Ludd <solar@g.o>
> Gentoo Linux Developer (Hardened)
>
>
> --
> gentoo-hardened@g.o mailing list

-- 
A long-forgotten loved one will appear soon.

Buy the negatives at any price.

--
gentoo-hardened@g.o mailing list