From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 20404 invoked from network); 23 Sep 2004 01:49:16 +0000 Received: from smtp.gentoo.org (156.56.111.197) by lists.gentoo.org with AES256-SHA encrypted SMTP; 23 Sep 2004 01:49:16 +0000 Received: from lists.gentoo.org ([156.56.111.196] helo=parrot.gentoo.org) by smtp.gentoo.org with esmtp (Exim 4.41) id 1CAIjS-0006aO-8f for arch-gentoo-dev@lists.gentoo.org; Thu, 23 Sep 2004 01:49:14 +0000 Received: (qmail 6584 invoked by uid 89); 23 Sep 2004 01:49:13 +0000 Mailing-List: contact gentoo-dev-help@gentoo.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@gentoo.org Received: (qmail 2713 invoked from network); 23 Sep 2004 01:49:13 +0000 Message-ID: <41522C3F.9080506@comcast.net> Date: Wed, 22 Sep 2004 21:51:59 -0400 From: John Richard Moser User-Agent: Mozilla Thunderbird 0.7.3 (X11/20040916) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Marius Mauch CC: gentoo-dev@lists.gentoo.org References: <4151A04F.5090304@comcast.net> <1095896982.15523.2843.camel@simple> <1095895057.8913.3.camel@helen.science.oregonstate.edu> <200409222026.50032.vapier@gentoo.org> <20040923023702.1ca5d9b2@andy.genone.homeip.net> In-Reply-To: <20040923023702.1ca5d9b2@andy.genone.homeip.net> X-Enigmail-Version: 0.85.0.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [gentoo-dev] Stack smash protected daemons X-Archives-Salt: dd44645a-e0ce-4002-ada5-563941baf2ee X-Archives-Hash: 1982f86e1545c5e923539216cbe7b50b -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Marius Mauch wrote: | On 09/22/04 Mike Frysinger wrote: | | |>On Wednesday 22 September 2004 07:17 pm, Donnie Berkholz wrote: |> [...] |>that said, what needs to be done here in order to get the ball rolling |>? can we simply put together a function in flag-o-matic which will |>check FEATURES and ARCH and gcc, and then just `append-flags |>-fstack-protector` ? then in our system packages, just call this |>function ...-mike | | | What exactly would that FEATURE do ? If it really only affects CFLAGS I | don't see the need for another FEATURE flag at all. We already have ~30 | different flags, please lets try to avoid another USE desaster by not | adding new flags for trivial stuff. | Users could add -fstack-protector for global stack smash protection; what's proposed here is to alter certain packages to use - -fstack-protector based on their risk factor (the proposed measure of risk factor is if they're daemons, or if they're SETUID (chmod +s)). CFLAGS="-fstack-protector" *************************** *_ALL_PACKAGES____________* *__(Stack_Smash_Protected)* *_________________________* *_________________________* *_________________________* *_________________________* *_________________________* *************************** FEATURES="autossp" *************************** *_ALL_PACKAGES____________* *_________________________* *_________________________* ****************__________* *_DAEMONS______*__________* *_(Stack_Smash *__________* *___Protected)_*__________* *************************** Does this clearly enough illustrate the difference? Rather than protecting everything including, say, ufed vim and gedit, only the obvious players are given extra padding (it's more like lightweight bioarmor; padding is clunky and reduces dexterity too much). This is easily compared to a football game: FEATURES="autossp" protects the players; while CFLAGS="-fstack-protector" protects the players, referee, cheerleaders, crowd, announcers, and sponsors. It's pretty obvious you don't want two 300 pound giants ramming into each other with no protection; it's not so obvious that the football might get kicked too far and hit someone in the crowd in the jaw. Those that fear this bring their own damn padding. | Marius | - -- All content of all messages exchanged herein are left in the Public Domain, unless otherwise explicitly stated. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBUiw+hDd4aOud5P8RAiEgAJwOnPYfxYacjMvwhWD8JgDL2x4I6ACfZYH2 roG+jaC6Y6eyEMMZH6HTNuI= =Ozj/ -----END PGP SIGNATURE----- -- gentoo-dev@gentoo.org mailing list