Re: [gentoo-security] Re: [gentoo-dev] Stack smash protected daemons

[Miguel Filipe]

I second this!!
I would love to see gentoo be more "proactive by default"...
sanboxing services whenever possible (like its done with dhcpd and bind)
priv-separation wherever doable, inclusively porting software from
openbsd, like their new dhcp server and clients and ntp server :)

I say this but don't "show code" simply because i'm not that
experienced to implement "safer" code,
nor to chroot a lot of software, nor am I capable of evaluate if such
service is chrootable :)

for instance, would there be any advantage in chrooting mysql? what
about tomcat?
is java code free from the dreadfull buffer overflow + shellcode?

So.. I support very dearly this idea..

greetings to all,
and thanks to all gentoo developers for gentoo :D

On Wed, 22 Sep 2004 19:49:42 -0400, Ned Ludd <solar@g.o> wrote:
> On Wed, 2004-09-22 at 11:54, John Richard Moser wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > It may be prudent to use extra protection on certain ebuilds in standard
> > Gentoo profiles where the changes would be significant in the case of a
> > security fault in the program.  Such programs as daemons and chmod()+s
> > programs would be major targets for this sort of thing.
> >
> > The most immediately apparent route to take would be to have ebuilds
> > such as openssh, apache, and su stack smash protected.  This would
> > prevent common buffer overflow attacks from being used to compromise
> > security; such attacks would only cause the program attacked to abort,
> > which could still be used as a Denial of Service attack, but would not
> > allow successful intrusion.
> >
> > Gentoo ships gcc with stack smash protection built in.  This is
> > activated by -fstack-protector or -fstack-protector-all.  It would be
> > feasible to add one of these flags to an ebuild based on a FEATURES or
> > USE setting.
> >
> > I believe it would be a good idea to have such a FEATURES or USE flag on
> > by default in all profiles where SSP is supported.  In this manner, the
> > major targets of security attacks would automatically be protected;
> > while still allowing the user to disable the protection if the user
> > desires.  Users wanting more protection can simply add -fstack-protector
> > to CFLAGS, or use Hardened Gentoo.
> >
> > Any comments?  Would this be more suitable as a USE or a FEATURES setting?
>
>
> This would indeed significantly reduce impact of many existing security
> problems that could potentially introduce and execute arbitrary code.
>
> Yes this makes complete and total sense in the terms of what your saying
> here. Vs using hardened which is not ideal for everybody or all
> occasions(due to the other things it enables by default) to limit the
> use of -fstack-protector to/for setuid/setgid and services only.
>
> I fully support this idea for atleast all base system packages that fall
> under the conditions you have defined, and assuming to many trolls don't
> come out of the woodwork I would be willing start on it if you can make
> a detailed list.
>
> As far as a disable feature how about FEATURES="noautossp" ?
>
> >
> > - --
> > All content of all messages exchanged herein are left in the
> > Public Domain, unless otherwise explicitly stated.
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.6 (GNU/Linux)
> > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> >
> > iD8DBQFBUaBOhDd4aOud5P8RAv/sAKCGx+cy5D3U35jDvGEFV5fcInF2fwCfbvGM
> > QvF8iaV8fuNFVQcintwy+2o=
> > =4Gdc
> > -----END PGP SIGNATURE-----
> >
> > --
> > gentoo-dev@g.o mailing list
> --
> Ned Ludd <solar@g.o>
> Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer
>
>
>
>



-- 
Miguel Sousa Filipe

--
gentoo-security@g.o mailing list