Re: [gentoo-dev] Hardened PHP now in Gentoo

[Chris PeBenito <pebenito@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1307 bytes --]

On Wed, 2004-05-19 at 18:23, Tom Payne wrote:
> On Wed, May 19, 2004 at 08:52:02PM +0100, Stuart Herbert wrote:
> > Sorry, but I don't.  I'm sympathetic, and agree that USE flags shouldn't be 
> > added for the sake of it.  But I believe that the 'hardened' USE flag is for 
> > a different feature.  Combining the two does not make sense to me.
> > 
> > I'm not going to do it.

> hardened Gentoo meaning stack overflow protection, toolchain mods, etc. etc.
> is different to harder-to-exploit PHP. Hardened PHP (AIUI) is more like Safe
> mode in Ruby (and other scripting languages). The two are different things
> and should not be confused.

No, it means the same thing.  From the hardened php site:

Implemented protections (until now)

- Canary protection of the Zend Memory Manager
- Canary protection of Zend Linked Lists
- Protection against internal format string exploits
- Protection against arbitrary code inclusion
- Syslog logging of attackers IP

The first four are all hardened-like things, a la PaX, PIE, and SSP.

-- 
Chris PeBenito
<pebenito@gentoo.org>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]