devil-linux-develop

Re: [Devil-linux-develop] GCC stack smashing protector

[Heiko Z. <hz...@pr...>]

On 08/04/2003 05:02:37 PM Manu wrote:
>Heiko Zuerker a =E9crit:
>
>Hey guys,
>
>I successfully intregrated the GCC stack smashing protector into DL !
>For more information about this
>piece:http://www.research.ibm.com/trl/projects/security/ssp
>
>
>Hi =A0You Master ;-)

I just grew 2 more centimeters. ;-)

>Great feature it is; now, if I understand well, one have to enable
>fstack-protector in each compile script and see if it works well ??

Not really. It's enabled by default and you have to disable it for each=

application which doesn't work anymore. ;-)
I had to do this for the kernel (build/scripts/linux) and some other
modules, but there can still be some apps out there which have problems=

once you try to run them.

Heiko
=

Re: [Devil-linux-develop] GCC stack smashing protector

[Heiko Z. <hz...@pr...>]

Hey,

On 08/04/2003 10:41:36 AM "Heiko Zuerker" wrote:
>I successfully intregrated the GCC stack smashing protector into DL !
>For more information about this piece:
>http://www.research.ibm.com/trl/projects/security/ssp

I just checked in a few more updates into CVS and uploaded updates to t=
he
FTP Server.
Those changes should hopefully fix the last issues with the "GCC SSP".
You will have to do a "make mrproper" or you just wait until my tests a=
re
finished.

cya
  Heiko
=

Re: [Devil-linux-develop] GCC stack smashing protector

[Heiko Z. <hz...@pr...>]

On 08/07/2003 03:58:59 PM "Heiko Zuerker" wrote:
>Hey,
>
>On 08/04/2003 10:41:36 AM "Heiko Zuerker" wrote:
>>I successfully intregrated the GCC stack smashing protector into DL !=

>>For more information about this piece:
>>http://www.research.ibm.com/trl/projects/security/ssp
>
>I just checked in a few more updates into CVS and uploaded updates to
>the
>FTP Server.
>Those changes should hopefully fix the last issues with the "GCC SSP".=

>You will have to do a "make mrproper" or you just wait until my tests
>are
>finished.

It looks good. So far I didn't get any more error messages.

cya
  Heiko
=

RE: [Devil-linux-develop] GCC stack smashing protector

[Dean N. <di...@ti...>]

>>On 08/04/2003 05:02:37 PM Manu wrote:
>>>Heiko Zuerker a =E9crit:
>>>
>>>Hey guys,
>>>
>>>I successfully intregrated the GCC stack smashing protector into DL !
>>>For more information about this
>>piece:http://www.research.ibm.com/trl/projects/security/ssp
>>>
>>
>>Great feature it is; now, if I understand well, one have to enable
>>fstack-protector in each compile script and see if it works well ??
>
>Not really. It's enabled by default and you have to disable it for each
>application which doesn't work anymore. ;-)
>I had to do this for the kernel (build/scripts/linux) and some other
>modules, but there can still be some apps out there which have problems
>once you try to run them.
>
>Heiko

...i think i better stock up on CD's, because I sense that this is going =
to
take a few builds... :-)

Seriously, I thought that the PAX part of GRSecurity did this. Do we now
have TWO stack smashing protectors, or was the PAX one disabled?

Dean Nedelman
TimeLord Consulting

Re: [Devil-linux-develop] GCC stack smashing protector

[Heiko Z. <he...@zu...>]

Dean Nedelman wrote:
>>>On 08/04/2003 05:02:37 PM Manu wrote:
>>>
>>>>Heiko Zuerker a écrit:
>>>>
>>>>Hey guys,
>>>>
>>>>I successfully intregrated the GCC stack smashing protector into DL !
>>>>For more information about this
>>>
>>>piece:http://www.research.ibm.com/trl/projects/security/ssp
>>>
>>>Great feature it is; now, if I understand well, one have to enable
>>>fstack-protector in each compile script and see if it works well ??
>>
>>Not really. It's enabled by default and you have to disable it for each
>>application which doesn't work anymore. ;-)
>>I had to do this for the kernel (build/scripts/linux) and some other
>>modules, but there can still be some apps out there which have problems
>>once you try to run them.
>>
>>Heiko
> 
> 
> ...i think i better stock up on CD's, because I sense that this is going to
> take a few builds... :-)
> 
> Seriously, I thought that the PAX part of GRSecurity did this. Do we now
> have TWO stack smashing protectors, or was the PAX one disabled?

We didn't use the PAX patch for GCC. I didn't like it when I took a look 
at it, but can't remember what I didn't like.

So far it looks good, the CD bootet without any problems on my test server.

Heiko

Re: [Devil-linux-develop] GCC stack smashing protector

[Manu <ee...@fr...>]

Heiko Zuerker a écrit:

> Dean Nedelman wrote:
>
>>>> On 08/04/2003 05:02:37 PM Manu wrote:
>>>>
>>>>> Heiko Zuerker a écrit:
>>>>>
>>>>> Hey guys,
>>>>>
>>>>> I successfully intregrated the GCC stack smashing protector into DL !
>>>>> For more information about this
>>>>
>>>>
>>>> piece:http://www.research.ibm.com/trl/projects/security/ssp
>>>>
>>>> Great feature it is; now, if I understand well, one have to enable
>>>> fstack-protector in each compile script and see if it works well ??
>>>
>>>
>>> Not really. It's enabled by default and you have to disable it for each
>>> application which doesn't work anymore. ;-)
>>> I had to do this for the kernel (build/scripts/linux) and some other
>>> modules, but there can still be some apps out there which have problems
>>> once you try to run them.
>>>
>>> Heiko
>>
>>
>>
>> ...i think i better stock up on CD's, because I sense that this is 
>> going to
>> take a few builds... :-)
>>
>> Seriously, I thought that the PAX part of GRSecurity did this. Do we now
>> have TWO stack smashing protectors, or was the PAX one disabled?
>
>
> We didn't use the PAX patch for GCC. I didn't like it when I took a 
> look at it, but can't remember what I didn't like.
>
> So far it looks good, the CD bootet without any problems on my test 
> server.


I've read some docs and in the limitations, found somthing that maybe we 
could easily check :

...

    * When you specify the option -O3, the protection instruments may be
      eliminated by the optimizer.


in their comparisson charts, they didn't speak of the PAX patch from 
grsec ...;-)

Manu

>
> Heiko
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 
>
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>
>