Re: ProPolice/SSP in 7.0

Hi,

On Thu, Dec 27, 2007 at 11:52:02PM +0100, Dag-Erling Sm鷨grav wrote:
> Gunther Mayer <gunther.mayer@googlemail.com> writes:
> > I've known about ProPolice/SSP for a while now (from the Gentoo world)
> > and am aware that FreeBSD 7.0 doesn't yet support it though I know of
> > Jeremy Le Hen's patches (http://tataz.chchile.org/~tataz/FreeBSD/SSP/).
> 
> Wrong.  FreeBSD 7 has had SSP support since May; the patch you mention
> just turns it on by default.  You can probably achieve the same effect
> by adding -fstack-protector to CFLAGS and COPTFLAGS in make.conf.

This is mostly true.  Given that stack protection requires extra
symbols from either libc or GNU libssp, it is disabled to sys/boot/
stuff and could also be disabled for /rescue.  In order to compile the
kernel with SSP, it must contain the required symbols as well (the
canary and the stack smash handler).

Regards,
-- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"