Re: [gentoo-user] How to harden a system

[Adam Carter]

>
> Lastly, this in /etc/sysctl.conf. SYN cookies is kernel option. The fin
> timeout cut was to clear out tens of thousands of TIME_WAIT sessions.
> net.ipv4.tcp_fin_timeout = 20
> net.ipv4.tcp_syncookies = 1
>

Oh I just noticed that vtv is now default enabled for gcc, so you could try;
CXXFLAGS="${CFLAGS} -fvtable-verify=std"

I tried this on earlier gccs, and there was a fair bit of breakage so i
didnt persue it. Maybe i'll re-try with 7.2 to see how things have
progressed.

"security feature that verifies at run time, for every virtual call, that
the vtable
           pointer through which the call is made is valid for the type of
the
           object, and has not been corrupted or overwritten.  If an invalid
           vtable pointer is detected at run time, an error is reported and
           execution of the program is immediately halted"