Arch Linux

VikM

Member

Registered: 2007-11-10

Posts: 50

Improving security

Hello,

I frequently use abs and makepkg mainly because I have -fstack-protector-all in CFLAGS/CXXFLAGS. I'm doing this for years, and more than 99% of packages have no problem with this flag. Actually I can't remeber any problems at all, but I don't compile everything.
Could be -fstack-protector-all, or at least -fstack-protector, a default compiler flag? Maybe some other easy steps like LDFLAGS including "-z relro -z now -z noexecstack"? Maybe others compiler/linker flags, Fedora at least seems to make a good job using them.

whargoul

Member

From: Odense, Denmark

Registered: 2005-04-04

Posts: 546

Re: Improving security

Exactly how will that improve security?

---

Arch - It's something refreshing

hussam

Member

Registered: 2006-03-26

Posts: 572

Website

Re: Improving security

Maybe this option should be used for server applications only? squid/ssd/httpd etc..?
I don't think there is much use for it in applications such as gnome/kde/xfce or even xorg and the kernel. But it is definitely a good addition for server applications. Maybe someone with knowledge of compilers can give a better opinion.

VikM

Member

Registered: 2007-11-10

Posts: 50

Re: Improving security

Adds some protection for buffer overflows. Even unknown ones.
Here http://www.research.ibm.com/trl/projects/security/ssp started the "GCC extension for protecting applications from stack-smashing attacks", you can find information about it. Now it is in the official gcc for some releases. I'm not sure it has to be used everywhere, but it doesn't hurt. I use this on servers for network services and related (ssh, mail, http, php). An option to PKGBUILD to add package-specific options to the CFLAGS from /etc/makepkg.conf and precompiled packages with the stack protector would be great (imho, of course). At least for the packages commonly used on servers.

Last edited by VikM (2007-11-11 17:27:54)