Re: [gentoo-hardened] Hardened meeting summary 2010-05-16

[Magnus Granberg <zorry@gentoo.org>]

måndag 17 maj 2010 22.28.05 skrev  Ed W:
> On 16/05/2010 21:20, Magnus Granberg wrote:
> > Hi
> >
> > Here is the summary of the meeting 2010-05-16
> >
> > 1,0 Toolchain
> >   We have an open bug #318171 for the merge of SSP and GCC>=4.4.3
> > support. http://bugs.gentoo.org/show_bug.cgi?id=318171
> >   We are waiting for toolchain to approve the changes to toolchain.eclass
> > and glibc that we need. Then we will have GCC 4.4.3 and 4.5.0 with full
> > hardened (PIE/SSP) support in the tree. Grub need to be bumped to the new
> > patchset.
> >   We have no time line on it for we are waiting on toolchain.
> 
> I see a comment in there: "Cleaned some code and removed SSP support for
> gcc 4.3.X " - I think this might need some watching and perhaps a
> warning here?  Sounds like if you now update say a "stable" hardened
> amd64 machine pulling in stable gcc 4.3.X then you might be suddenly
> loosing your hardened compiler?
> 
> I understand this is avoided if using your overlay, but it seems like a
> potential pitfall for anyone using the "stable" hardened tree?
> 
> Can anyone comment if this is the case or I'm worrying over nothing?
> 
> Ta
> 
> Ed W
> 
I only removed the code for default enable option for SSP. GCC 4.3.X still 
support SSP if you add -fstack-protector. The GCC 4.4.3 is on the way to get 
stable in 1-4 weeks i hope. Is up to the archs teams now to mark it stablel.

Hardened at gentoo.org
Magnus Granberg (Zorry)