Re: [gentoo-hardened] binary protection mechanisms in different Linux distros

[Kyle Bader]

> Javier: good point, I haven't really considered the differences between the
> use of  fstack-protector and fstack-protector-all - maybe something to do in
> the future. Would there be a way to find out which option was used on a given
> binary 'post mortem'? (read: after compilation? ;))

While it doesn't differentiate between fstack-protector and
fstack-protector-all this script [1] can detect RELRO, canary, NX/PAX
& PIE:

[509] kyle@blah:~/security-bin$ ./checksec-new.sh --file buggy
RELRO           STACK CANARY      NX/PaX        PIE                     FILE
No RELRO        Canary found      NX enabled    No PIE                  buggy

[1] http://tk-blog.blogspot.com/2009/02/checksec.html
-- 

Kyle