Re: [gentoo-hardened] propolice in kernel

[Ned Ludd]

Peter,

I don't think anybody has proved that fstack-anything has any value what
so ever in the kernel. I would recommend Hiroaki Etoh be consulted about
about the technical merits of having a ssp enabled kernel as well as
expected performance impact. I'd personally like to see some POC for
this. (seeing is believing)

If it does have merit in a kernel then I think we can come back to 
the subject of adding some random data to it's __guard if not then I'm
going to recommend that it be removed from any Gentoo kernels which may
have this patch added.


On Tue, 2003-12-16 at 03:27, Peter S. Mazinger wrote:
> Hello!
>
> As it is implemented, __guard has a fixed value (so this is the "canary"
> implementation, less effective then random values as in ssp.c for glibc.
> PaX includes the function pax_get_random_long (get_random_long in
> grsecurity, grsecurity has also obsd_rand.c w/ some random function),
> that could be used for this.
>
> Peter
-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer