Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Security discussion: stack smash protection

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Security discussion: stack smash protection
  • Date: Mon, 27 Sep 2004 11:52:48 -0700

Theres been an interest in having the ability to set arbitrary compiler
flags to sorcery through the menu/config file and command line for quite
some time. This falls nicely into that bucket.

-Andrew

On Mon, Sep 27, 2004 at 06:38:39PM -0000, evraire AT tuwg.com wrote:
> Hey everyone,
> I just happened upon a very interesting thread in the Gent** forums[1]
> and learned about a very nifty feature in gcc called "stack smash
> protection", enabled by the -fstack-protector or -fstack-protector-all
> compiler flags. This feature can protect an application from most buffer
> overflow attacks, even for unknown vulnerabilities. I wonder whether we
> have support for these compiler flags in Source Mage, and if not I would
> really like to see it added in.
>
> Apparently there is a small performance hit in the application depending
> on how much string manipulation it performs, so while adding it to the
> sorcery menu as a global on/off switch is possible I think it would be best
> to enable/disable this on a per-spell basis. For example, I don't think I
> would care whether or not MPlayer uses this (as I personally don't stream
> too much content from the Net), but I would like all my public servers
> (MySQL, Apache, PHP, SSH, etc.) to be compiled with this extra layer of
> protection.
>
> I am writing this to all of you in the interest of starting a discussion
> about this and other possible security measures we can add to our
> distribution. So please, if you have any thoughts about this, I invite you
> to chime in.
>
> I'm providing a few links[2-6], mostly about the stack smash protection
> feature but some are simply related. All of these links were extracted
> from the Gent** thread (but it's not an exhaustive list by far).
>
> Looking forward to what people have to say!
>
> Jonathan Evraire
> evraire at tuwg.com
>
>
> [1] http://thread.gmane.org/gmane.linux.gentoo.devel/21468
> [2] http://www.trl.ibm.com/projects/security/ssp/main.html
> [3]
> http://www.research.ibm.com/trl/projects/security/ssp/node5.html#SECTION00051000000000000000
> [4]
> http://www.ida.liu.se/~johwi/research_publications/paper_ndss2003_john_wilander.pdf
> [5] http://www.research.avayalabs.com/project/libsafe/
> [6] http://dev.gentoo.org/~vapier/mudflap.pdf
>
>
> -------------------------------------------------------------
> Message sent via http://toad-mail.net
> Anti-spam notice, this message originated from IP Address: 199.212.215.11
> -------------------------------------------------------------
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss

--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | |
|Sorcery Team Lead, Porting Team Lead | |
|Grimoire Guru ham/smgl | ftp://t.armory.com |
|Author and Maintainer of Prometheus | |
--------------------------------------------------------------------------

Attachment: pgptQAAmLsnyp.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page