Re: New GCC options: -fcf-protection & -fstack-clash-protection

On including RAP: it would be great, but RAP is a commercial product : =
while it=E2=80=99s probably possible to enable its use in Gentoo for =
people who are customers of Open Source Security=E2=80=99s (assuming one =
of the customers for RAP is also a member of the gentoo-hardened project =
or can become one, so that the integration is maintained over time), =
including RAP in Gentoo per se will not work.

Regarding fcf-protection, good catch: while I initially read the =
"Currently the x86 GNU/Linux target provides an implementation based on =
Intel Control-flow Enforcement Technology (CET)=E2=80=9D bit in the GCC =
documentation, I didn=E2=80=99t catch initially that it required =
hardware support. After looking into it further, it doesn=E2=80=99t seem =
that Intel has any processor on the market with this technology yet. =
Effectively, that means no one can take advantage of this at this time, =
unless they=E2=80=99re Intel.

Regarding stack-clash: Looking at GCC=E2=80=99s source code, it seems to =
be limited to arches where the stack grows downwards, which includes =
major arches such as i386 (w/ amd64 too), arm and powerpc. This is =
further confirmed by looking into GCC=E2=80=99s test suite.
References:
* https://github.com/gcc-mirror/gcc/blob/gcc-8-branch/gcc/toplev.c#L1685=20=

* =
https://github.com/gcc-mirror/gcc/blob/gcc-8-branch/gcc/testsuite/lib/targ=
et-supports.exp#L9236-L9249


Best,

=E2=80=93 Guillaume Ceccarelli

> On Feb 24, 2019, at 19:56, T=C3=B3th Attila <[email protected]> =
wrote:
>=20
> I'm not a lawyer either, but it's not legal to copy RAP, especially =
since
> the great crisis. It's trademarked and protected. It's a pity some
> companies abused the goodwill of the developers and misused grsec
> technologies in the past.
> Dw.
> --=20
> dr T=C3=B3th Attila, Radiol=C3=B3gus, 06-20-825-8057
> Attila Toth MD, Radiologist, +36-20-825-8057
>=20
> 2019.Febru=C3=A1r 24.(V) 19:18 id=C5=91pontban Javier Juan Martinez =
Cabezon ezt =C3=ADrta:
>>=20
>> It's would be feasible to include Grsec RAP gcc plugin in gentoo =
hardened?
>>=20
>> I think it would be a better alternative  than fcf-protection does
>>=20
>>=20
>> On 24/02/19 16:16, "T=C3=B3th Attila" wrote:
>>> Dear Guillaume,
>>>=20
>>> I'm not a Gentoo Dev either.
>>>=20
>>> If there's a place to promote useful gcc flags from their security
>>> aspect,
>>> Gentoo Hardened is a good place to become a leader of such efforts -
>>> like
>>> it happened in the past.
>>>=20
>>> 1. Regarding fcf-protection:
>>> "Currently the x86 GNU/Linux target provides an implementation based =
on
>>> Intel Control-flow Enforcement Technology (CET)."
>>> - anybody knows which Intel processor actually supports that since =
its
>>> announcement in 2016?
>>> - also it worth to take a look at on these comments by Spender @
>>> grsecurity:
>>> =
https://grsecurity.net/effectiveness_of_intel_cet_against_code_reuse_attac=
ks.php
>>> It would be good if hardware developers would discuss their plans =
with
>>> more security experts before they put something into production.
>>>=20
>>> 2. Regarding stack-clash
>>> "Most targets do not fully support stack clash protection."
>>> - some information would be helpful to elaborate a little bit more =
on
>>> "not
>>> fully" and exactly which targets we are talking about. Anybody has a
>>> more
>>> detailed documentation?
>>>=20
>>> Best regards:
>>> Dw.
>>>=20
>>=20
>>=20
>=20
>=20
>=20