From owner-freebsd-current@FreeBSD.ORG Fri May 26 15:35:06 2006 Return-Path: X-Original-To: freebsd-current@FreeBSD.org Delivered-To: freebsd-current@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 38BB316A43C; Fri, 26 May 2006 15:35:06 +0000 (UTC) (envelope-from tataz@tataz.chchile.org) Received: from smtp5-g19.free.fr (smtp5-g19.free.fr [212.27.42.35]) by mx1.FreeBSD.org (Postfix) with ESMTP id 005A643D64; Fri, 26 May 2006 15:34:59 +0000 (GMT) (envelope-from tataz@tataz.chchile.org) Received: from tatooine.tataz.chchile.org (tataz.chchile.org [82.233.239.98]) by smtp5-g19.free.fr (Postfix) with ESMTP id F170027608; Fri, 26 May 2006 17:34:58 +0200 (CEST) Received: from obiwan.tataz.chchile.org (unknown [192.168.1.25]) by tatooine.tataz.chchile.org (Postfix) with ESMTP id C0E099CCE8; Fri, 26 May 2006 15:35:14 +0000 (UTC) Received: by obiwan.tataz.chchile.org (Postfix, from userid 1000) id A3C5C40A5; Fri, 26 May 2006 17:34:22 +0200 (CEST) Date: Fri, 26 May 2006 17:34:22 +0200 From: Jeremie Le Hen To: freebsd-current@FreeBSD.org, freebsd-security@FreeBSD.org Message-ID: <20060526153422.GB25953@obiwan.tataz.chchile.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.11 Cc: Subject: Integrating ProPolice/SSP into FreeBSD X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 May 2006 15:35:07 -0000 Hi, first sorry for cross-posting but I thought this patch might interest -CURRENT users as well as people concerned by security. I wrote a patch that integrates ProPolice/SSP into FreeBSD, one step further than it has been realized so far. It is available here : http://tataz.chchile.org/~tataz/FreeBSD/SSP/ Everything is explained on the web page, but I will repeat some informations here. The patchset is splitted in two parts to ease the review of the patch. The -propolice patch is only the original ProPolice patch for GCC 3.4.4 applied on FreeBSD source tree. The -freebsd patch contains the glue I have written to make things neat. The patch exists in both for CURRENT and RELENG_6. Both introduce a new make.conf(5) (and src.conf(5)) knob to enable stack protection on a per Makefile basis. It if of course possible to compile your world with it. Please refer to the web page for more informations. The patch has been tested and works pretty well. My laptop and my workstation at work are compiled with SSP : world, kernel and ports, including X.org. I hope you will enjoy it. Regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >