Re: [gentoo-dev] Hardening a default profile

[Matthias Maier <tamiko@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1622 bytes --]

> there should be a way of turning these off systematically.  the
> advantage of the current hardened gcc specs is that one can switch
> between them using gcc-config.  if these are forced on for the default
> profile then there will be no easy way to systematically turn them off.

No - there won't be an easy way for systematically turning off
SSP and PIE in 17.0 profiles [1,2].

The hardened toolchain with its different gcc profiles came from a time
where SSP and PIE were relatively new security features and a certain
amount of fine-grained control was needed. Further, at that time we were
talking about external patches against gcc. Nowadays everything is
upstreamed and (almost) no patches to gcc for hardened profiles are
applied any more.

Given the fact that all major linux distributions are following the path
of improved default hardening features (see for example [1]) and that we
have been using ssp/pie in hardened profiles for years now the purpose
of fine-grained control over ssp/pie is also highly questionable.

The consensus at the moment is that PIE and SSP (as well as stricter
linker flags) will soon be standard (or, actually *are* already
standard) compilation options. A per-package override (if absoluetely
needed) is fine - and, in fact, already in place everywhere where
needed.

Thus, we should go with the time and simply force these well tested
hardening features on platforms that support it.

Best,
Matthias

[1] for amd64/x86 and well supported profiles

[2] there is always the possibility to override forced use flags

[1] https://wiki.debian.org/Hardening/PIEByDefaultTransition

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 850 bytes --]