From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1RpPl2-0006ny-L0 for garchives@archives.gentoo.org; Mon, 23 Jan 2012 19:40:49 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 505C6E093A; Mon, 23 Jan 2012 19:40:35 +0000 (UTC) Received: from homiemail-a3.g.dreamhost.com (mailbigip.dreamhost.com [208.97.132.5]) by pigeon.gentoo.org (Postfix) with ESMTP id 4BBA9E072F for ; Mon, 23 Jan 2012 19:40:08 +0000 (UTC) Received: from homiemail-a3.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a3.g.dreamhost.com (Postfix) with ESMTP id C0779284087 for ; Mon, 23 Jan 2012 11:40:07 -0800 (PST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=zx2c4.com; h=mime-version :in-reply-to:references:date:message-id:subject:from:to:cc: content-type; q=dns; s=zx2c4.com; b=SHIiBBP9BH3NQPAxVfSqOXLLF9At w1PEzlHGdXUhf37g9T9O+bR3yNR0mtCUeKg/REI9UJAH97X9DmYXeUkfCtWgEV25 6jZCMRn0UEitv4kMGnCen33sFcZZ0yb2BJu+nO1v0gCRNSiaG7ewQHQ7ai28MtZi YIQ9whKtf5Mv0jQ= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=mime-version :in-reply-to:references:date:message-id:subject:from:to:cc: content-type; s=zx2c4.com; bh=Lgv20p3MwEdOITw8oviXXJwgG/Q=; b=R0 a39otTU76+YvpMiPutXhQaxiTOzVuCN4fmj3UBcxYSjpSGFqU9GGAxK44hMYjUlH APmNXPMGrJTl6103frnf/j0lQPOx6LpGKL5NQeg4IglQeMIQkY0h5DaNRwnS4E5A 5xqDbMmhOZx+MYswoNFs3lSI1g/w+C+6YrrJQIB5Y= Received: from mail-qy0-f181.google.com (mail-qy0-f181.google.com [209.85.216.181]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jason@zx2c4.com) by homiemail-a3.g.dreamhost.com (Postfix) with ESMTPSA id 8EADA28406A for ; Mon, 23 Jan 2012 11:40:07 -0800 (PST) Received: by qcpx40 with SMTP id x40so2140904qcp.40 for ; Mon, 23 Jan 2012 11:40:05 -0800 (PST) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Received: by 10.229.78.89 with SMTP id j25mr3337211qck.46.1327347605864; Mon, 23 Jan 2012 11:40:05 -0800 (PST) Received: by 10.229.146.193 with HTTP; Mon, 23 Jan 2012 11:40:05 -0800 (PST) In-Reply-To: <1327347460.60706.44.camel@titan.home.flameeyes.eu> References: <1327346549.60706.35.camel@titan.home.flameeyes.eu> <1327347460.60706.44.camel@titan.home.flameeyes.eu> Date: Mon, 23 Jan 2012 20:40:05 +0100 Message-ID: Subject: [gentoo-dev] Re: Can we get PIE on all SUID binaries by default, por favor? From: "Jason A. Donenfeld" To: =?ISO-8859-1?Q?Diego_Elio_Petten=F2?= Cc: gentoo-dev@lists.gentoo.org Content-Type: multipart/alternative; boundary=00235429d3748a7fce04b73732c6 X-Archives-Salt: 29a5b85a-1059-4d9d-8dbe-55f6854d1216 X-Archives-Hash: 60604dd40e6252b2a48b86236ece8593 --00235429d3748a7fce04b73732c6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On Mon, Jan 23, 2012 at 20:37, Diego Elio Petten=F2 w= rote: > > Stripping a compiled file of read permissions is quick, painless and > (mostly) safe from errors. Changing the way it is compiled.. not so > much. > > I'm not saying that it's not a good idea, but if we want to proceed with > this, there has to be someone who goes to look at all the packages and > corrects them. > > Right. It's a big ordeal. I'm *not* suggesting, however, that we automatically inject a CFLAG or something awful like that. What I propose is just to *detect* at merge-time whether or not there are SUID binaries that are not PIE, and if so, spit out a Q&A warning. That way, package maintainers could fix things up bit by bit, without having to burden you alone with tinderbox troubles. --00235429d3748a7fce04b73732c6 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

On Mon, Jan 23, 2012 at 20:37, Diego Eli= o Petten=F2 <f= lameeyes@gentoo.org> wrote:
Stripping a compiled file of read permissions is quick, painless and
(mostly) safe from errors. Changing the way it is compiled.. not so
much.

I'm not saying that it's not a good idea, but if we want to proceed= with
this, there has to be someone who goes to look at all the packages and
corrects them.


Right. It's a bi= g ordeal. I'm not=A0suggesting, however, that we automatically i= nject a CFLAG or something awful like that.

What I= propose is just to detect=A0at merge-time whether or not there are = SUID binaries that are not PIE, and if so, spit out a Q&A warning.=A0

That way, package maintainers could fix things up bit b= y bit, without having to burden you alone with tinderbox troubles.
--00235429d3748a7fce04b73732c6--