search for: ssp

Hi, first sorry for cross-posting but I thought this patch might interest -CURRENT users as well as people concerned by security. I wrote a patch that integrates ProPolice/SSP into FreeBSD, one step further than it has been realized so far. It is available here : http://tataz.chchile.org/~tataz/FreeBSD/SSP/ Everything is explained on the web page, but I will repeat some informations here. The patchset is splitted in two parts to ease the review of the patch. The...

...king DESCRIPTION meta-information ... OK * cleaning src * installing the package to re-build vignettes * Installing *source* package ?MCMCglmm? ... ** libs g++ -m64 -I/usr/include/R -I/usr/local/include -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -c MCMCglmm.cc -o MCMCglmm.o MCMCglmm.cc: In function ?void MCMCglmm(double*, double*, double*, int*, int*, int*, int*, int*, int*, double*, int*, int*, double*, int*, int*, double*, double*, int*, int*, int*, int*, int*, int*, int*, int*, int*, int*, doubl...

...king DESCRIPTION meta-information ... OK * cleaning src * installing the package to re-build vignettes * Installing *source* package ?MCMCglmm? ... ** libs g++ -m64 -I/usr/include/R -I/usr/local/include -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -c MCMCglmm.cc -o MCMCglmm.o MCMCglmm.cc: In function ?void MCMCglmm(double*, double*, double*, int*, int*, int*, int*, int*, int*, double*, int*, int*, double*, int*, int*, double*, double*, int*, int*, int*, int*, int*, int*, int*, int*, int*, int*, doubl...

...checking DESCRIPTION meta-information ... OK * cleaning src * installing the package to re-build vignettes * Installing *source* package ?MCMCglmm? ... ** libs g++ -m64 -I/usr/include/R -I/usr/local/include -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -c MCMCglmm.cc -o MCMCglmm.o MCMCglmm.cc: In function ?void MCMCglmm(double*, double*, double*, int*, int*, int*, int*, int*, int*, double*, int*, int*, double*, int*, int*, double*, double*, int*, int*, int*, int*, int*, int*, int*, int*, int*, int*, double*, doub...

...2 on various servers without any tweaks (GENERIC kernel, binary updates via freebsd-update etc.) but lots of ports (apache, postgresql, diablo-jdk etc.) and would like to use stack smashing protection in order to harden my boxes and avoid many potential exploits. I've known about ProPolice/SSP for a while now (from the Gentoo world) and am aware that FreeBSD 7.0 doesn't yet support it though I know of Jeremy Le Hen's patches (http://tataz.chchile.org/~tataz/FreeBSD/SSP/). Some time after 7.0 is released I'd like to upgrade and apply SSP throughout kernel, userland and por...

Ports and Package users, Ports now have SSP enabled by default. The package repository will now build SSP by default as well. SSP is "Stack Smashing Protection" and can be read about at https://en.wikipedia.org/wiki/Buffer_overflow_protection. This only applies to the head (/latest) packages, not the Quarterly branch packages....

Ports and Package users, Ports now have SSP enabled by default. The package repository will now build SSP by default as well. SSP is "Stack Smashing Protection" and can be read about at https://en.wikipedia.org/wiki/Buffer_overflow_protection. This only applies to the head (/latest) packages, not the Quarterly branch packages....

Ports and Package users, Ports now have SSP enabled by default. The package repository will now build SSP by default as well. SSP is "Stack Smashing Protection" and can be read about at https://en.wikipedia.org/wiki/Buffer_overflow_protection. This only applies to the head (/latest) packages, not the Quarterly branch packages....

...reetype and FTGL configure: creating ./config.status config.status: creating src/Makevars ** libs g++ -m32 -I/usr/include/R -DHAVE_PNG_H -DHAVE_FREETYPE -Iext/ftgl -I/usr/include/freetype2 -Iext -I/usr/local/include -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables -c BBoxDeco.cpp -o BBoxDeco.o g++ -m32 -I/usr/include/R -DHAVE...

I'm still working on SSP support in LLVM. We have code that is in an IR pass StackProtector, SelectionDAG, FastISel, and some MachineFunction passes. Even in SelectiondDAG we have different code paths. I wonder if we can at least have only two code paths, one for SelectionDAG and the other for FastISel. IR pass may genera...

...5 sums checked ** libs g++ -m64 -I/usr/include/R -DNDEBUG -I../inst/include -DCOMPILING_DPLYR -I/usr/local/include -I"/usr/lib64/R/library/Rcpp/include" -I"/usr/lib64/R/library/BH/include" -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -c RcppExports.cpp -o RcppExports.o g++ -m64 -I/usr/include/R -DNDEBUG -I../inst/include -DCOMPILING_DPLYR -I/usr/local/include -I"/usr/lib64/R/library/Rcpp/include" -I"/usr/lib64/R/library/BH/include" -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY...

Hi, My understanding of a "dead" register is a def that is never used. However, when I dump the MI after reg alloc on a simple program I see the following sequence: ADJCALLSTACKDOWN64 0, 0, 0, *implicit-def dead %rsp*, implicit-def dead %eflags, implicit-def dead %ssp, implicit %rsp, implicit %ssp CALL64pcrel32 @foo, <regmask %bh %bl %bp %bpl %bx %ebp %ebx %rbp %rbx %r12 %r13 %r14 %r15 %r12b %r13b %r14b %r15b %r12d %r13d %r14d %r15d %r12w %r13w %r14w %r15w>, *implicit %rsp*, implicit %ssp, implicit-def %rsp, implicit-def %ssp ADJCALLSTACKUP64 0, 0, implici...

...cked > ** libs > g++ -m64 -I/usr/include/R -DNDEBUG -I../inst/include -DCOMPILING_DPLYR -I/usr/local/include -I"/usr/lib64/R/library/Rcpp/include" -I"/usr/lib64/R/library/BH/include" -fpic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -c RcppExports.cpp -o RcppExports.o > g++ -m64 -I/usr/include/R -DNDEBUG -I../inst/include -DCOMPILING_DPLYR -I/usr/local/include -I"/usr/lib64/R/library/Rcpp/include" -I"/usr/lib64/R/library/BH/include" -fpic -O2 -g -pipe -Wall -Wp,-D_FO...

...ementally. I'm looking for any feedback (suggestions, requests, etc) before I actually begin the work. Thank you! Josh ====================================== Stack-protector-strong support in LLVM ====================================== Introduction ------------ Stack Smashing Protection (SSP) aims to protect against buffer overflow attacks by placing a 'canary' value on the stack that is validated upon exiting a function. LLVM currently supports SSP. Specifically it supports two modes: -fstack-protector-all - enables stack protectors for all functions -fstack-protecto...

...re_addrinfo_sockaddr(const struct addrinfo *ai, --- clientname.c.orig Fri Jan 10 21:05:56 2003 +++ clientname.c Thu Apr 1 10:57:05 2004 @@ -101,58 +101,58 @@ char *client_name(int fd) static char name_buf[100]; static char port_buf[100]; static int initialised; - struct sockaddr_storage ss, *ssp; - struct sockaddr_in sin; -#ifdef INET6 - struct sockaddr_in6 sin6; -#endif - socklen_t ss_len; + struct sockaddr_storage ss; - if (initialised) return name_buf; + if (initialised) + return name_buf; strcpy(name_buf, default_name); initialised = 1; + memset(&ss, 0, sizeof(ss)); +...

Does anybody know why two "-g" flags appear in the call to gcc in R CMD SHLIB Example: gcc -std=gnu99 -I/usr/share/R/include -DNDEBUG -fpic *-g* -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 *-g* -c c_file1.c -o c_object1.o Surely it need only be listed once? Alan [[alternative HTML version deleted]]

...k test checking and how does it fail? My m4 macro is really simple, TRY_LINK a simple program with the stack protect CFLAGS: AC_DEFUN([XIPH_GCC_STACK_PROTECTOR], [AC_LANG_ASSERT(C) AC_MSG_CHECKING([if $CC supports stack smash protection]) xiph_stack_check_old_cflags="$CFLAGS" SSP_FLAGS="-fstack-protector --param ssp-buffer-size=4" CFLAGS=$SSP_FLAGS AC_TRY_LINK([ #include <stdio.h> ], [puts("Hello, World!"); return 0;], AC_MSG_RESULT([yes]) CFLAGS="$xiph_stack_check_old_cflags $SSP_FLAGS", AC_MSG_RESULT([no]) CFLAGS=&qu...

...My understanding of a "dead" register is a def that is never used. However, > when I dump the MI after reg alloc on a simple program I see the > following sequence: > > ADJCALLSTACKDOWN64 0, 0, 0, *implicit-def dead %rsp*, implicit-def dead > %eflags, implicit-def dead %ssp, implicit %rsp, implicit %ssp > CALL64pcrel32 @foo, <regmask %bh %bl %bp %bpl %bx %ebp %ebx %rbp %rbx > %r12 %r13 %r14 %r15 %r12b %r13b %r14b %r15b %r12d %r13d %r14d %r15d > %r12w %r13w %r14w %r15w>, *implicit %rsp*, implicit %ssp, implicit-def > %rsp, implicit-def %ssp > AD...

https://bugzilla.mindrot.org/show_bug.cgi?id=1538 Summary: improve SSP detection Product: Portable OpenSSH Version: 5.1p1 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: Build system AssignedTo: unassigned-bugs at mindrot.org ReportedBy...

...rtial hack. My two (maybe four?) cents. -- John T. > > Thank you! > Josh > > > ====================================== > Stack-protector-strong support in LLVM > ====================================== > > Introduction > ------------ > Stack Smashing Protection (SSP) aims to protect against buffer overflow attacks > by placing a 'canary' value on the stack that is validated upon exiting a > function. > > LLVM currently supports SSP. Specifically it supports two modes: > -fstack-protector-all > - enables stack protectors for a...