Re: Gentoo Hardened and Stack Clash

This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.

--=_zucker.schokokeks.org-27740-1498127406-0001-2
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi,

I'm not claiming that I understand all the issues, but I wonder how
that all affects "normal" Gentoo.

Let me summarize my understanding:
* We currently enable -fstack-check=3Dspecific on hardened, but not on
  normal Gentoo.
* -fstack-check provides protection against stack clashes, but it is
  not ideal / can sometimes be circumvented. However it is expected /
  hoped that future versions of gcc will improve on that and provide a
  better implementation.
* According to gcc's man page I understand that -fstack-check=3Dspecific
  is equivalent to -fstack-check and there is also
  -fstack-check=3Dgeneric, which is considered deprecated.

There's already work underway to push -pie via a new profile to default
gentoo. I wonder: Should -fstack-check be pushed as well?

Open questions I have:
* Are there measurements of the performance overhead of -fstack-check?
* Are there other downsides of -fstack-check? Is it expected that
  enabling it breaks things?

--=20
Hanno B=C3=B6ck
https://hboeck.de/

mail/jabber: [email protected]
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

--=_zucker.schokokeks.org-27740-1498127406-0001-2
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE/nN1f6YOTiG5N1efpYgAcru1HkIFAllLnCoACgkQpYgAcru1
HkL48w/8DaR7yUQcVGHl36QSVBzwvgvBrQojzo1YYm6n/KjC3VjAFCBjqxLZkAe4
5jqxPijgQMrCGgAOjL8ItputkD+NTEc0FYFkicRadVjHhzC+oN75XBCMuOLIML8V
nM42lELKYK7RMrioqbQejZi2dfy6ZG4kSd4DozMsvNfNa9hd9EvoFWFUdDKM+2ZJ
igtxQ18ZplhHo55hd8htuuUso1cuhtmll8SsahivwQMqKdfZpunz37KcPNFOESrl
W0fMUABBmpLAJtoHFdJEMhivyFvUXZFh8VTAnMASe5LrF1dTatSHLZEQHQhfdzjN
P/NISjzzP+p+lZyEIITlE/dNMBml/pYfpDgZU4ibfMpUrrPq1dRJ6s5h6tOx/54C
MpVagU+HmDbPZHltmzDamjfc092hjYNs8RNsNZOGHn1OJzd8ygZteJd2w2bRkPh9
DidxKi6Q0lEReDQLNpC9ZGzVWfd4N/mcTEfeLLPzFgO8RHFMvWBDk3/gNqpP43w2
kdWQUAervaUQbTdBCoXmnmeqjCWAfhYXV2Xq/vDEtMN8hw4/AseisUQDCBV8fbnB
nWKLLl5Y9gsNzxZczNuouoljeGUtqVhcArI6UnReb3GN5vu+nQZh+hsQ0n/ARYfj
IxNtC7R2TW1ycESvcBC9rXkvsgFXr+xFISF1y9Uhgq/RDNRUFQY=
=B0Xo
-----END PGP SIGNATURE-----

--=_zucker.schokokeks.org-27740-1498127406-0001-2--