Public SourceMage Discussion List

[evraire AT tuwg.com]

Hey everyone,
  I just happened upon a very interesting thread in the Gent** forums[1] and 
learned about a very nifty feature in gcc called "stack smash protection", 
enabled by the -fstack-protector or -fstack-protector-all compiler flags.  
This feature can protect an application from most buffer overflow attacks, 
even for unknown vulnerabilities.  I wonder whether we have support for these 
compiler flags in Source Mage, and if not I would really like to see it added 
in.

  Apparently there is a small performance hit in the application depending on 
how much string manipulation it performs, so while adding it to the sorcery 
menu as a global on/off switch is possible I think it would be best to 
enable/disable this on a per-spell basis.  For example, I don't think I would 
care whether or not MPlayer uses this (as I personally don't stream too much 
content from the Net), but I would like all my public servers (MySQL, Apache, 
PHP, SSH, etc.) to be compiled with this extra layer of protection.

  I am writing this to all of you in the interest of starting a discussion 
about this and other possible security measures we can add to our 
distribution.  So please, if you have any thoughts about this, I invite you 
to chime in.

  I'm providing a few links[2-6], mostly about the stack smash protection 
feature but some are simply related.  All of these links were extracted from 
the Gent** thread (but it's not an exhaustive list by far).

  Looking forward to what people have to say!

  Jonathan Evraire
  evraire at tuwg.com


[1] http://thread.gmane.org/gmane.linux.gentoo.devel/21468
[2] http://www.trl.ibm.com/projects/security/ssp/main.html
[3] 
http://www.research.ibm.com/trl/projects/security/ssp/node5.html#SECTION00051000000000000000
[4] 
http://www.ida.liu.se/~johwi/research_publications/paper_ndss2003_john_wilander.pdf
[5] http://www.research.avayalabs.com/project/libsafe/
[6] http://dev.gentoo.org/~vapier/mudflap.pdf


-------------------------------------------------------------
Message sent via http://toad-mail.net
Anti-spam notice, this message originated from IP Address: 199.212.215.11
-------------------------------------------------------------