Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

Theres been an interest in having the ability to set arbitrary compiler
flags to sorcery through the menu/config file and command line for quite
some time. This falls nicely into that bucket.

-Andrew

On Mon, Sep 27, 2004 at 06:38:39PM -0000, evraire AT tuwg.com wrote:
> Hey everyone,
>   I just happened upon a very interesting thread in the Gent** forums[1] 
> and learned about a very nifty feature in gcc called "stack smash 
> protection", enabled by the -fstack-protector or -fstack-protector-all 
> compiler flags.  This feature can protect an application from most buffer 
> overflow attacks, even for unknown vulnerabilities.  I wonder whether we 
> have support for these compiler flags in Source Mage, and if not I would 
> really like to see it added in.
> 
>   Apparently there is a small performance hit in the application depending 
> on how much string manipulation it performs, so while adding it to the 
> sorcery menu as a global on/off switch is possible I think it would be best 
> to enable/disable this on a per-spell basis.  For example, I don't think I 
> would care whether or not MPlayer uses this (as I personally don't stream 
> too much content from the Net), but I would like all my public servers 
> (MySQL, Apache, PHP, SSH, etc.) to be compiled with this extra layer of 
> protection.
> 
>   I am writing this to all of you in the interest of starting a discussion 
> about this and other possible security measures we can add to our 
> distribution.  So please, if you have any thoughts about this, I invite you 
> to chime in.
> 
>   I'm providing a few links[2-6], mostly about the stack smash protection 
> feature but some are simply related.  All of these links were extracted 
> from the Gent** thread (but it's not an exhaustive list by far).
> 
>   Looking forward to what people have to say!
> 
>   Jonathan Evraire
>   evraire at tuwg.com
> 
> 
> [1] http://thread.gmane.org/gmane.linux.gentoo.devel/21468
> [2] http://www.trl.ibm.com/projects/security/ssp/main.html
> [3] 
> http://www.research.ibm.com/trl/projects/security/ssp/node5.html#SECTION00051000000000000000
> [4] 
> http://www.ida.liu.se/~johwi/research_publications/paper_ndss2003_john_wilander.pdf
> [5] http://www.research.avayalabs.com/project/libsafe/
> [6] http://dev.gentoo.org/~vapier/mudflap.pdf
> 
> 
> -------------------------------------------------------------
> Message sent via http://toad-mail.net
> Anti-spam notice, this message originated from IP Address: 199.212.215.11
> -------------------------------------------------------------
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss

-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    |                             |
|Sorcery Team Lead, Porting Team Lead      |                             |
|Grimoire Guru ham/smgl                    | ftp://t.armory.com          |
|Author and Maintainer of Prometheus       |                             |
--------------------------------------------------------------------------

Attachment: pgptQAAmLsnyp.pgp
Description: PGP signature