Re: Top 5 things that aren't in Debian but should be :-)
Russell,
That's helpful. This is exactly the sort of thing I am looking for...
minimal things that can be applied which tend towards "secure by
default" without breaking everything in sight.
On Thu, Jan 15, 2004 at 04:39:34PM +1100, Russell Coker wrote:
> On Mon, 12 Jan 2004 20:12, Martin Pitt <martin@piware.de> wrote:
> > It would be nice to provide better proactive system security out of
> > the box: e.g. mandatory access control and ACLs
> > (grsecurity|SELinux|lids), PaX, all packages compiled with buffer
> > overflow protection and a gcc supporting this (like Steve Kemp's gcc).
>
> SE Linux is in 2.6.0 and 2.6.1. Herbert has stated that he will build SE
> Linux into 2.6.1 if he has time.
Good. Doesn't cost anything if you don't use it, or at least, if the
costs are noticeable for you you'll be building your own kernel anyway.
> For PaX to be considered we need someone to maintain a kernel-patch-pax
> package that contains a patch which applies to a Debian kernel source.
> No-one has been willing to do this so far.
>
> Steve Kemp's gcc has been working well for me. I've built kernels and
> applications with it and not found any problems. I expect that it will
> become a standard feature in Debian's gcc soon.
What makes you so confident about this? I agree that Steve's GCC
(packaging some work from IBM research, see http://www.steve.org.uk)
seems to work but there's a long jump between that and saying it is
ready to unleash on everyone. I've not heard any reports from embedded
users for example and I've never asked gdb developers what they think of
it either -- just to pick two examples of possible problems that occur
to me on the spot. Maybe someone has done lots of homework on this, the
IBM people perhaps.
--
Dan Shearer
dan@shearer.org
Reply to: