From: Michael Orlitzky <mjo@gentoo.org>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] Anyone running a hardened profile?
Date: Mon, 7 Sep 2015 14:27:38 -0400 [thread overview]
Message-ID: <55EDD71A.1060707@gentoo.org> (raw)
In-Reply-To: <20150907191004.19395757@hal9000.localdomain>
On 09/07/2015 01:10 PM, wabenbau@gmail.com wrote:
> Michael Orlitzky <mjo@gentoo.org> wrote:
>
> I don't think so (but maybe I'm wrong). You have to compile your entire
> system with a hardened toolchain to get full hardened support (SSP and
> maybe some other things). I think, to go back to a "normal state", you
> have to recompile everything again with a non hardened toolchain.
>
GCC 4.8 already defaults to -fstack-protector, but you do need to
recompile to get -fstack-protector-all and you're right that you would
need to recompile again to make it go away. The full SSP is considered
safe though, and only slows things down a bit.
For PaX, the markings may exist on your filesystem, but if you switch to
a non-hardened kernel they cease to have any effect. Grsec just goes away.
next prev parent reply other threads:[~2015-09-07 18:28 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-06 20:15 [gentoo-user] Anyone running a hardened profile? walt
2015-09-06 20:52 ` [gentoo-user] " James
2015-09-06 20:59 ` [gentoo-user] " Hinnerk van Bruinehsen
2015-09-06 21:53 ` Fernando Rodriguez
2015-09-07 17:02 ` wabenbau
2015-09-08 1:07 ` Fernando Rodriguez
2015-09-06 22:06 ` Michael Orlitzky
2015-09-07 17:10 ` wabenbau
2015-09-07 18:27 ` Michael Orlitzky [this message]
2015-09-08 1:15 ` [gentoo-user] " walt
2015-09-08 1:34 ` Fernando Rodriguez
2015-09-08 1:38 ` Michael Orlitzky
2015-09-08 20:42 ` Fernando Rodriguez
2015-09-06 23:09 ` [gentoo-user] " Andreas K. Huettel
2015-09-07 17:07 ` wabenbau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55EDD71A.1060707@gentoo.org \
--to=mjo@gentoo.org \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox