Date: Thu, 16 Nov 2000 19:59:56 -0600 (CST) From: Mike Silbersack <silby@silby.com> To: Warner Losh <imp@village.org> Cc: Kris Kennaway <kris@FreeBSD.ORG>, KOJIMA Hajime <kjm@rins.ryukoku.ac.jp>, security@FreeBSD.ORG Subject: Re: FYI: Propolice for gcc-2.95.2 Message-ID: <Pine.BSF.4.21.0011161940530.62772-100000@achilles.silby.com> In-Reply-To: <200011170108.SAA70664@harmony.village.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 16 Nov 2000, Warner Losh wrote: > In message <20001116170042.A58481@citusc17.usc.edu> Kris Kennaway writes: > : > I'd worry about putting this into the base system. First, I'd worry > : > about the performance impact of all this extra code in the base > : > system. Second, I'd worry about bitrot when we move to new versions > : > of the source. > : > : Performance shouldn't be an issue unless you enable the extra bounds > : checking at compile time. > > Right. I guess I'd worry about this being enabled by default as a way > of "solving" all stack smashing problems. If it is just a knob to > enable for those that want to enable it, I'd be cool with that. On the contrary, if the support is imported, it should be enabled by default. The simple fact is that those most likely to install badly written software are also probably unaware of how to change the options and rebuild world / ports. Additionally, a default on configuration would allow the distinction of being able to say that FreeBSD is not vulnerable when a certain normally vulnerable port is installed, where other OSes are vulnerable. Of course, that's assuming two things: 1. Propolice actually stops some attacks. While it looks great in theory, it doesn't sound like any commonly exploited apps have been tested for resiliance with propolice compilation. 2. Propolice doesn't break anything. With the number of ports, this sounds like it could be extremely hard to figure out. However, if they've successfully recompiled redhat with it, it can't break that many programs. Obviously the kernel wouldn't be compiled with Propolice ever. A compilation of world with it would be nice in theory, but would certainly raise claims of slowdown. Perhaps apps could be selectively added|removed from the list of protected apps in the base system based on their suid status and auditness? Ports are really where the security's going to be an issue, as will the speed... I'd think propolice should be on there by default. Experienced users concerned with apache running as fast as possible can use flags to cause its protections not to be used when compiling. I guess the argument is analagous to disabling telnet by default. (Note that after saying that, I haven't tried the patches whatsoever, I don't want to break gcc. Could some compiler expert tell us if it works cleanly on FreeBSD?) Mike "Silby" Silbersack To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0011161940530.62772-100000>