Date: Sun, 30 Dec 2007 14:31:07 +0100 From: Jeremie Le Hen <jeremie@le-hen.org> To: Dag-Erling =?iso-8859-1?Q?Sm=F8rgrav?= <des@des.no> Cc: Gunther Mayer <gunther.mayer@googlemail.com>, freebsd-security@freebsd.org Subject: Re: ProPolice/SSP in 7.0 Message-ID: <20071230133107.GE10467@obiwan.tataz.chchile.org> In-Reply-To: <86myrvhht9.fsf@ds4.des.no> References: <477277FF.30504@googlemail.com> <86myrvhht9.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, On Thu, Dec 27, 2007 at 11:52:02PM +0100, Dag-Erling Smørgrav wrote: > Gunther Mayer <gunther.mayer@googlemail.com> writes: > > I've known about ProPolice/SSP for a while now (from the Gentoo world) > > and am aware that FreeBSD 7.0 doesn't yet support it though I know of > > Jeremy Le Hen's patches (http://tataz.chchile.org/~tataz/FreeBSD/SSP/). > > Wrong. FreeBSD 7 has had SSP support since May; the patch you mention > just turns it on by default. You can probably achieve the same effect > by adding -fstack-protector to CFLAGS and COPTFLAGS in make.conf. This is mostly true. Given that stack protection requires extra symbols from either libc or GNU libssp, it is disabled to sys/boot/ stuff and could also be disabled for /rescue. In order to compile the kernel with SSP, it must contain the required symbols as well (the canary and the stack smash handler). Regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20071230133107.GE10467>