Public SourceMage Discussion List

[Arwed von Merkatz <v.merkatz AT gmx.net>]

On Tue, Sep 20, 2005 at 05:41:31PM +0200, Thomas HOUSSIN wrote:
> Hi all, 
> 
> You may have heard about the hardened grimoire. The goal of this
> grimoire is to add various security features to Source Mage : for
> example support of Stack Smashing Protector (
> http://www.trl.ibm.com/projects/security/ssp/), full support of
> grsecurity, PaX, etc. See
> http://wiki.sourcemage.org/index.php?page=Hardened+Grimoire for more
> about it.
> 
> I began to work on this a while ago. I didn't change anything in
> perforce for a long time, but installed a test machine (which I didn't
> have anymore) and tested lots of spells (including kde, gnome, etc). I
> didn't notice any major problems ; next step now would be to integrate
> this work in the devel grimoire. This would bring nice new features,
> but also more work and bugs reports, especially at the beginning (and
> especially I guess the non-executable pages feature in PaX), more than
> security team alone can handle. So the question is : do you want
> some/all of these features in devel, and which ones ?
 
In theory we'll want most of those in devel. In practice they should be
merged one after the other so they can settle in a bit on their own
before the next one comes in. I see the main problem in supporting those
things without having them installed on your machine, as many of our
developers will probably continue to run systems without those features.

What kind of problems show up in spells that break in hardened, and how
hard are those to reproduce and/or fix?

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org