| 1 |
On Monday 16 February 2004 06:56 am, Ned Ludd wrote: |
| 2 |
> On Sun, 2004-02-15 at 13:07, Eric P. wrote: |
| 3 |
> > Hello, All: |
| 4 |
> > |
| 5 |
> > I'm emerge'ing a _new_ system and realized later that I *may* have made a |
| 6 |
> > mistake: |
| 7 |
> > |
| 8 |
> > I added '-fstack-protector' to CFLAGS and began emerge'ing the |
| 9 |
> > system without emerge'ing hardened-gcc first. |
| 10 |
> > |
| 11 |
> > According the the propolice.xml page, SSP has been included in gcc since |
| 12 |
> > 3.2.3-r1 so - it is my understanding that - the '-fstack-protector' |
| 13 |
> > should enhance the security of the system against buffer-overflows. But |
| 14 |
> > by not using hardened-gcc, I'm concerned that I may have missed-out on a |
| 15 |
> > critical security enhancement. |
| 16 |
> |
| 17 |
> You have. |
| 18 |
> But without a kernel to support it would do little good. |
| 19 |
> |
| 20 |
> >Should I re-emerge the entire system or just emerge hardened-gcc before |
| 21 |
> > emerge'ing grsec-sources? |
| 22 |
> |
| 23 |
> The kernel has been known not to play along with hgcc at times so |
| 24 |
> probably your best bet is building your kernel beforehand and then |
| 25 |
> merging hardened-gcc then finishing it off with an emerge -e world |
| 26 |
|
| 27 |
Thanks, Ned. I'm still a bit confused though: Without a kernel to support |
| 28 |
hardened-gcc, it doesn't do much to enhance security *but* when I compile a |
| 29 |
kernel I should disable hardened-gcc? |
| 30 |
|
| 31 |
The Handbook instructs to... |
| 32 |
|
| 33 |
1. emerge system |
| 34 |
2. emerge <kernel> |
| 35 |
3. build the kernel |
| 36 |
|
| 37 |
How should I integrate the hardened-gcc ebuild into this? Since SSP is already |
| 38 |
integrated into gcc-3.2.3-r1 I added "-fstack-protector" to CFLAGS before |
| 39 |
doing any of this. |
| 40 |
|
| 41 |
Eric P. |
| 42 |
|
| 43 |
-- |
| 44 |
gentoo-hardened@g.o mailing list |
Archives