On Sun, Jul 25, 2004 at 02:26:15PM -0400, John Richard Moser wrote: > | I have been flirting with SSP for months now, but the most recent > | patches included with GCC do not apply cleanly. Watch for a bug > | against GCC shortly with updated SSP patches. > | > > Yeah I think on 3.3.4 on Gentoo has SSP It does. > The binutils adds the header field needed for the PaX flags for paxctl. > ~ This is important, because chpax uses an "unused" area in the header, > which is depricated. Also, tools like strip will zero the chpax flags, > making them extremely volitile. Shouldn't strip be updated to ignore this 'unused' field, or would it be more sensible to set aside a real area for the flag? ELF is simple to update with new sections and maybe adding support for the runtime loader/linker would be more future proof.. > | SSP is remarkably simple to apply and works with all packages I've > | been able to test on x86. > | > > Firefox sets off SSP itself on load. When you say 'sets of' do you mean disable? I find that unlikely, as it's not the kind of thing that can be disabled when all the canary checking code is incorporated into the binary... > "Stack Smash Protection" is the new name of ProPolice? o_o Thought > that was the name of the concept. SSP is the name for one implementation of stack smashing protection which was previously known as ProPolice. It's available from IBM at the following URL: http://www.trl.ibm.com/projects/security/ssp/ > | I've not noticed this - Mozilla certainly seems fine with SSP > | compilers. I've been using it on my own unstable boxes for some > | time. What, specifically, breaks? > | > > Not sure. I'm going by what I've been told by the Gentoo devs; I'm a > Hardened Gentoo user. But interested in Debian? > SELinux and SSP do two different things. SSP prevents the program from > being exploited; SELinux contains the exploit. That's a simplistic explaination .. but it's not too far from the truth ;) > PaX also aims to prevent the program from being exploited. The randomization is an interesting technique and it seems sufficiently simple concept that it would be interesting to see how well it works. Steve --
Attachment:
pgpYcOvRfuaw6.pgp
Description: PGP signature