Hi,
first sorry for cross-posting but I thought this patch might interest
-CURRENT users as well as people concerned by security.
I wrote a patch that integrates ProPolice/SSP into FreeBSD, one step
further than it has been realized so far.
It is available here :
http://tataz.chchile.org/~tataz/FreeBSD/SSP/
Everything is explained on the web page, but I will repeat some
informations here. The patchset is splitted in two parts to ease the
review of the patch. The -propolice patch is only the original
ProPolice patch for GCC 3.4.4 applied on FreeBSD source tree. The
-freebsd patch contains the glue I have written to make things neat.
The patch exists in both for CURRENT and RELENG_6. Both introduce a
new make.conf(5) (and src.conf(5)) knob to enable stack protection
on a per Makefile basis. It if of course possible to compile your
world with it. Please refer to the web page for more informations.
The patch has been tested and works pretty well. My laptop and my
workstation at work are compiled with SSP : world, kernel and ports,
including X.org.
I hope you will enjoy it.
Regards,
--
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >
On Fri, 26 May 2006, Jeremie Le Hen wrote:> first sorry for cross-posting but I thought this patch might interest > -CURRENT users as well as people concerned by security. > > I wrote a patch that integrates ProPolice/SSP into FreeBSD, one step further > than it has been realized so far.This looks very neat. Could you remind me what, if any, ABI issues might exist? I'm familiar with the ideas behind ProPolice, but not the implementation. Can I use SSP-compied libraries with pre-SSP applications? Can I use post-SSP applications with pre-SSP binaries? At various points in the past, the issue of integrating stack protection techniques into the gcc code has come up. Did this ever go anywhere? Even Microsoft's compiler suite ships with statically compiled stack protection these days. In the past we've avoided local compiler changes in order to make it easier to track the vendor and avoid losing local compiler changes when upgrading. Robert N M Watson> > It is available here : > http://tataz.chchile.org/~tataz/FreeBSD/SSP/ > > Everything is explained on the web page, but I will repeat some > informations here. The patchset is splitted in two parts to ease the > review of the patch. The -propolice patch is only the original > ProPolice patch for GCC 3.4.4 applied on FreeBSD source tree. The > -freebsd patch contains the glue I have written to make things neat. > > The patch exists in both for CURRENT and RELENG_6. Both introduce a > new make.conf(5) (and src.conf(5)) knob to enable stack protection > on a per Makefile basis. It if of course possible to compile your > world with it. Please refer to the web page for more informations. > > The patch has been tested and works pretty well. My laptop and my > workstation at work are compiled with SSP : world, kernel and ports, > including X.org. > > I hope you will enjoy it. > Regards, > -- > Jeremie Le Hen > < jeremie at le-hen dot org >< ttz at chchile dot org > > _______________________________________________ > freebsd-current@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" >
On Fri, 26 May 2006 17:34:22 +0200 Jeremie Le Hen <jeremie@le-hen.org> wrote:> Hi, > > first sorry for cross-posting but I thought this patch might interest > -CURRENT users as well as people concerned by security. > > I wrote a patch that integrates ProPolice/SSP into FreeBSD, one step > further than it has been realized so far. > > It is available here : > http://tataz.chchile.org/~tataz/FreeBSD/SSP/ > > Everything is explained on the web page, but I will repeat some > informations here. The patchset is splitted in two parts to ease the > review of the patch. The -propolice patch is only the original > ProPolice patch for GCC 3.4.4 applied on FreeBSD source tree. The > -freebsd patch contains the glue I have written to make things neat. > > The patch exists in both for CURRENT and RELENG_6. Both introduce a > new make.conf(5) (and src.conf(5)) knob to enable stack protection > on a per Makefile basis. It if of course possible to compile your > world with it. Please refer to the web page for more informations. > > The patch has been tested and works pretty well. My laptop and my > workstation at work are compiled with SSP : world, kernel and ports, > including X.org. > > I hope you will enjoy it. > Regards, > -- > Jeremie Le Hen > < jeremie at le-hen dot org >< ttz at chchile dot org > > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to > "freebsd-security-unsubscribe@freebsd.org"How does this compare to GCC 4.x mudflap feature? I do not plan to include Propolice patch into base system any time soon and will object anyone trying to do so due to future maintenance headaches this will inevitably create. GCC 4.1.1 import is in the works though and should be available shortly. -- Alexander Kabaev -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20060526/26317f87/signature.pgp
Hi list, I haven't got much feedback so far. I would be glad if any people who have been using this patch told be if they have been faced with some problems. Thank you Regards, Jeremie On Fri, May 26, 2006 at 05:34:22PM +0200, Jeremie Le Hen wrote:> Hi, > > first sorry for cross-posting but I thought this patch might interest > -CURRENT users as well as people concerned by security. > > I wrote a patch that integrates ProPolice/SSP into FreeBSD, one step > further than it has been realized so far. > > It is available here : > http://tataz.chchile.org/~tataz/FreeBSD/SSP/ > > Everything is explained on the web page, but I will repeat some > informations here. The patchset is splitted in two parts to ease the > review of the patch. The -propolice patch is only the original > ProPolice patch for GCC 3.4.4 applied on FreeBSD source tree. The > -freebsd patch contains the glue I have written to make things neat. > > The patch exists in both for CURRENT and RELENG_6. Both introduce a > new make.conf(5) (and src.conf(5)) knob to enable stack protection > on a per Makefile basis. It if of course possible to compile your > world with it. Please refer to the web page for more informations. > > The patch has been tested and works pretty well. My laptop and my > workstation at work are compiled with SSP : world, kernel and ports, > including X.org. > > I hope you will enjoy it. > Regards,-- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >