Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Gentoo: Security
Stack smash protected daemons
 

Index | Next | Previous | View Flat


nigelenki at comcast

Sep 22, 2004, 8:54 AM


Views: 2247
Permalink
Stack smash protected daemons

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It may be prudent to use extra protection on certain ebuilds in standard
Gentoo profiles where the changes would be significant in the case of a
security fault in the program. Such programs as daemons and chmod()+s
programs would be major targets for this sort of thing.

The most immediately apparent route to take would be to have ebuilds
such as openssh, apache, and su stack smash protected. This would
prevent common buffer overflow attacks from being used to compromise
security; such attacks would only cause the program attacked to abort,
which could still be used as a Denial of Service attack, but would not
allow successful intrusion.

Gentoo ships gcc with stack smash protection built in. This is
activated by -fstack-protector or -fstack-protector-all. It would be
feasible to add one of these flags to an ebuild based on a FEATURES or
USE setting.

I believe it would be a good idea to have such a FEATURES or USE flag on
by default in all profiles where SSP is supported. In this manner, the
major targets of security attacks would automatically be protected;
while still allowing the user to disable the protection if the user
desires. Users wanting more protection can simply add -fstack-protector
to CFLAGS, or use Hardened Gentoo.

Any comments? Would this be more suitable as a USE or a FEATURES setting?

- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBUaBOhDd4aOud5P8RAv/sAKCGx+cy5D3U35jDvGEFV5fcInF2fwCfbvGM
QvF8iaV8fuNFVQcintwy+2o=
=4Gdc
-----END PGP SIGNATURE-----

--
gentoo-security [at] gentoo mailing list

Subject User Time
Stack smash protected daemons nigelenki at comcast Sep 22, 2004, 8:54 AM
    Re: Stack smash protected daemons klausman at schwarzvogel Sep 22, 2004, 11:46 AM
    Re: [gentoo-dev] Stack smash protected daemons solar at gentoo Sep 22, 2004, 4:49 PM
        Re: Re: [gentoo-dev] Stack smash protected daemons miguel.filipe at gmail Sep 22, 2004, 8:00 PM
    Re: [gentoo-dev] Stack smash protected daemons nigelenki at comcast Sep 22, 2004, 9:01 PM
        Re: [gentoo-dev] Stack smash protected daemons nigelenki at comcast Sep 22, 2004, 9:06 PM
        Re: OT: Re: [gentoo-dev] Stack smash protected daemons trs-gml at simulakrum Sep 22, 2004, 9:20 PM
            Re: OT: Re: [gentoo-dev] Stack smash protected daemons nigelenki at comcast Sep 22, 2004, 9:22 PM
                Re: OT: Re: [gentoo-dev] Stack smash protected daemons trs-gml at simulakrum Sep 22, 2004, 9:47 PM
            Re: OT: Re: [gentoo-dev] Stack smash protected daemons nigelenki at comcast Sep 22, 2004, 10:31 PM
                Re: OT: Re: [gentoo-dev] Stack smash protected daemons BarrySchwartz124 at comcast Sep 23, 2004, 8:37 AM
        Re: [gentoo-dev] Stack smash protected daemons solar at gentoo Sep 22, 2004, 10:26 PM
            Re: Stack smash protected daemons koon at gentoo Sep 23, 2004, 1:31 AM
                Re: Stack smash protected daemons koon at gentoo Sep 23, 2004, 7:05 AM
                    Re: [gentoo-dev] Re: Stack smash protected daemons nigelenki at comcast Sep 23, 2004, 8:21 PM
                        Re: [gentoo-dev] Re: Stack smash protected daemons solar at gentoo Sep 23, 2004, 11:02 PM
                            Re: [gentoo-dev] Re: Stack smash protected daemons nigelenki at comcast Sep 23, 2004, 11:34 PM
                Re: Re: Stack smash protected daemons nigelenki at comcast Sep 23, 2004, 10:27 AM
    Re: [gentoo-dev] Stack smash protected daemons nigelenki at comcast Sep 26, 2004, 11:39 AM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.