miguel.filipe at gmail
Sep 22, 2004, 8:00 PM
Post #4 of 19
I second this!!
Re: Re: [gentoo-dev] Stack smash protected daemons
[In reply to]
I would love to see gentoo be more "proactive by default"...
sanboxing services whenever possible (like its done with dhcpd and bind)
priv-separation wherever doable, inclusively porting software from
openbsd, like their new dhcp server and clients and ntp server :)
I say this but don't "show code" simply because i'm not that
experienced to implement "safer" code,
nor to chroot a lot of software, nor am I capable of evaluate if such
service is chrootable :)
for instance, would there be any advantage in chrooting mysql? what
is java code free from the dreadfull buffer overflow + shellcode?
So.. I support very dearly this idea..
greetings to all,
and thanks to all gentoo developers for gentoo :D
On Wed, 22 Sep 2004 19:49:42 -0400, Ned Ludd <solar [at] gentoo> wrote:
> On Wed, 2004-09-22 at 11:54, John Richard Moser wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > It may be prudent to use extra protection on certain ebuilds in standard
> > Gentoo profiles where the changes would be significant in the case of a
> > security fault in the program. Such programs as daemons and chmod()+s
> > programs would be major targets for this sort of thing.
> > The most immediately apparent route to take would be to have ebuilds
> > such as openssh, apache, and su stack smash protected. This would
> > prevent common buffer overflow attacks from being used to compromise
> > security; such attacks would only cause the program attacked to abort,
> > which could still be used as a Denial of Service attack, but would not
> > allow successful intrusion.
> > Gentoo ships gcc with stack smash protection built in. This is
> > activated by -fstack-protector or -fstack-protector-all. It would be
> > feasible to add one of these flags to an ebuild based on a FEATURES or
> > USE setting.
> > I believe it would be a good idea to have such a FEATURES or USE flag on
> > by default in all profiles where SSP is supported. In this manner, the
> > major targets of security attacks would automatically be protected;
> > while still allowing the user to disable the protection if the user
> > desires. Users wanting more protection can simply add -fstack-protector
> > to CFLAGS, or use Hardened Gentoo.
> > Any comments? Would this be more suitable as a USE or a FEATURES setting?
> This would indeed significantly reduce impact of many existing security
> problems that could potentially introduce and execute arbitrary code.
> Yes this makes complete and total sense in the terms of what your saying
> here. Vs using hardened which is not ideal for everybody or all
> occasions(due to the other things it enables by default) to limit the
> use of -fstack-protector to/for setuid/setgid and services only.
> I fully support this idea for atleast all base system packages that fall
> under the conditions you have defined, and assuming to many trolls don't
> come out of the woodwork I would be willing start on it if you can make
> a detailed list.
> As far as a disable feature how about FEATURES="noautossp" ?
> > - --
> > All content of all messages exchanged herein are left in the
> > Public Domain, unless otherwise explicitly stated.
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.6 (GNU/Linux)
> > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> > iD8DBQFBUaBOhDd4aOud5P8RAv/sAKCGx+cy5D3U35jDvGEFV5fcInF2fwCfbvGM
> > QvF8iaV8fuNFVQcintwy+2o=
> > =4Gdc
> > -----END PGP SIGNATURE-----
> > --
> > gentoo-dev [at] gentoo mailing list
> Ned Ludd <solar [at] gentoo>
> Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer
Miguel Sousa Filipe
gentoo-security [at] gentoo mailing list