Re: Secure Linux From Scratch

Jonas Norlander <[email protected]>
Newsgroups gmane.linux.lfs.security
Message-ID <[email protected]>
ashes wrote:
> I have been actively developing a hardened Linux from Scratch for about a 
> month or two. I have propolice, gcc-3.4's -pie backport, which takes advatage 
> of the Pax kernel patch for randomized memory address space, and the entire 
> LFS system builds with both protections with the exception of the kernel 
> itself, and grub.
I have successfuly compiled my LFS 5.0 system including the
kernel except grub with the propolice patch. I used the attached patch
on kernel 2.4.22 to make it compile with propolice.
Perhaps anyone with more knowledge can modifie it for 2.4.23 and submit
it to the pathlist?

> Adding a read only encrypted filesystem would be trivial. 
> Building a trusted system takes a trusted host system. In my opinion it would 
> take two simutainious LFS builds to construct a trusted system (trusted by 
> us). If there is enough interest in designing a Secure LFS book count me in. 
> We will need some sort of website and maybe a seperate mailing list. More 
> importantly we need a security policy for the design. What I consider 
> important to security maybe isn't what others think. I have also been doing 
> some light auditing, the grades depend on version of the software. For 
> example coreutils-5.0.91 software was less submissive to attack then 
> coreutils-5.0 (using bfbtester). I am not too impressed with selinux, it's 
> policies are not manditory; the attacker just needs to exploit a protocol not 
> recognised by selinux, such as ipv6 (who knows what else).
> I would also like to note there are countless "secure" linux implementations, 
> and if we are to start a new one it better be good or its not worth doing. In 
> most, if not all, distributions, security is sacrificed for marketing and 
> user friendlyness. I dont mean this as a rant, but more as the truth, systems 
> like debain, gentoo, redhat, and even openbsd, care more about the money in 
> their pocket then the quality of the system they ship. I hope this is where 
> LFS is different since its not marketed for the masses.
> Security starts with the toolchain, and no software is exempt from audit.
> 
> Sorry for the late follow up.
>

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page
2.4.20-propolice-build.patch (text/plain, 8.9 KB)
diff -urN linux-2.4.21-rc3-nossp/arch/alpha/Makefile linux-2.4.21-rc3/arch/alpha/Makefile
--- linux-2.4.21-rc3-nossp/arch/alpha/Makefile	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/alpha/Makefile	2003-05-26 12:52:53.000000000 -0400
@@ -84,6 +84,10 @@
 endif
 CFLAGS := $(CFLAGS) -Wa,-mev6
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
 HEAD := arch/alpha/kernel/head.o
 
 SUBDIRS := $(SUBDIRS) arch/alpha/kernel arch/alpha/mm arch/alpha/lib \
diff -urN linux-2.4.21-rc3-nossp/arch/alpha/config.in linux-2.4.21-rc3/arch/alpha/config.in
--- linux-2.4.21-rc3-nossp/arch/alpha/config.in	2003-05-26 13:56:38.000000000 -0400
+++ linux-2.4.21-rc3/arch/alpha/config.in	2003-05-26 12:52:16.000000000 -0400
@@ -22,6 +22,9 @@
   bool 'Set version information on all symbols for modules' CONFIG_MODVERSIONS
   bool 'Kernel module loader' CONFIG_KMOD
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/i386/Makefile linux-2.4.21-rc3/arch/i386/Makefile
--- linux-2.4.21-rc3-nossp/arch/i386/Makefile	2003-05-26 13:56:39.000000000 -0400
+++ linux-2.4.21-rc3/arch/i386/Makefile	2003-05-26 12:10:48.000000000 -0400
@@ -94,6 +94,10 @@
 CFLAGS += $(call check_gcc,-march=c3-2,-march=i686)
 endif
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
 HEAD := arch/i386/kernel/head.o arch/i386/kernel/init_task.o
 
 SUBDIRS += arch/i386/kernel arch/i386/mm arch/i386/lib
diff -urN linux-2.4.21-rc3-nossp/arch/i386/config.in linux-2.4.21-rc3/arch/i386/config.in
--- linux-2.4.21-rc3-nossp/arch/i386/config.in	2003-05-26 13:56:39.000000000 -0400
+++ linux-2.4.21-rc3/arch/i386/config.in	2003-05-26 12:45:53.000000000 -0400
@@ -256,6 +256,9 @@
 if [ "$CONFIG_SMP" = "y" -a "$CONFIG_X86_CMPXCHG" = "y" ]; then
    define_bool CONFIG_HAVE_DEC_LOCK y
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/m68k/Makefile linux-2.4.21-rc3/arch/m68k/Makefile
--- linux-2.4.21-rc3-nossp/arch/m68k/Makefile	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/m68k/Makefile	2003-05-26 12:51:45.000000000 -0400
@@ -54,6 +54,10 @@
 CFLAGS := $(subst -fomit-frame-pointer,,$(CFLAGS)) -g
 endif
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
 ifndef CONFIG_SUN3
 HEAD := arch/m68k/kernel/head.o
 else
diff -urN linux-2.4.21-rc3-nossp/arch/m68k/config.in linux-2.4.21-rc3/arch/m68k/config.in
--- linux-2.4.21-rc3-nossp/arch/m68k/config.in	2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/m68k/config.in	2003-05-26 12:51:17.000000000 -0400
@@ -83,6 +83,9 @@
       bool 'Use write-through caching for 68060 supervisor accesses' CONFIG_060_WRITETHROUGH
    fi
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/mips/Makefile linux-2.4.21-rc3/arch/mips/Makefile
--- linux-2.4.21-rc3-nossp/arch/mips/Makefile	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/mips/Makefile	2003-05-26 12:50:52.000000000 -0400
@@ -98,6 +98,9 @@
 AFLAGS		+= $(GCCFLAGS)
 CFLAGS		+= $(GCCFLAGS)
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
 
 #
 # We unconditionally build the math emulator
diff -urN linux-2.4.21-rc3-nossp/arch/mips/config-shared.in linux-2.4.21-rc3/arch/mips/config-shared.in
--- linux-2.4.21-rc3-nossp/arch/mips/config-shared.in	2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/mips/config-shared.in	2003-05-26 12:50:04.000000000 -0400
@@ -545,6 +545,9 @@
 else
    define_bool CONFIG_CPU_HAS_SYNC y
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/ppc/Makefile linux-2.4.21-rc3/arch/ppc/Makefile
--- linux-2.4.21-rc3-nossp/arch/ppc/Makefile	2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/ppc/Makefile	2003-05-26 12:44:19.000000000 -0400
@@ -46,6 +46,10 @@
   CFLAGS += $(shell echo $(CONFIG_COMPILE_OPTIONS) | sed -e 's/"//g')
 endif
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
 ifdef CONFIG_4xx
   HEAD := arch/ppc/kernel/head_4xx.o
 else
diff -urN linux-2.4.21-rc3-nossp/arch/ppc/config.in linux-2.4.21-rc3/arch/ppc/config.in
--- linux-2.4.21-rc3-nossp/arch/ppc/config.in	2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/ppc/config.in	2003-05-26 12:47:22.000000000 -0400
@@ -141,6 +141,9 @@
 if [ "$CONFIG_8xx" = "y" -o "$CONFIG_8260" = "y" ]; then
     define_bool CONFIG_EMBEDDEDBOOT y
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/sparc/Makefile linux-2.4.21-rc3/arch/sparc/Makefile
--- linux-2.4.21-rc3-nossp/arch/sparc/Makefile	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc/Makefile	2003-05-26 12:48:42.000000000 -0400
@@ -30,6 +30,10 @@
 CFLAGS := $(CFLAGS) -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
 endif
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
 #LINKFLAGS = -N -Ttext 0xf0004000
 LINKFLAGS = -T arch/sparc/vmlinux.lds
 
diff -urN linux-2.4.21-rc3-nossp/arch/sparc/config.in linux-2.4.21-rc3/arch/sparc/config.in
--- linux-2.4.21-rc3-nossp/arch/sparc/config.in	2003-05-26 13:56:43.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc/config.in	2003-05-26 12:47:34.000000000 -0400
@@ -19,6 +19,9 @@
    bool '  Set version information on all symbols for modules' CONFIG_MODVERSIONS
    bool '  Kernel module loader' CONFIG_KMOD
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/sparc64/Makefile linux-2.4.21-rc3/arch/sparc64/Makefile
--- linux-2.4.21-rc3-nossp/arch/sparc64/Makefile	2003-05-26 13:56:43.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc64/Makefile	2003-05-26 12:53:36.000000000 -0400
@@ -58,6 +58,10 @@
   CFLAGS := $(CFLAGS) -pg
 endif
 
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
 LINKFLAGS = -T arch/sparc64/vmlinux.lds
 
 HEAD := arch/sparc64/kernel/head.o arch/sparc64/kernel/init_task.o
diff -urN linux-2.4.21-rc3-nossp/arch/sparc64/config.in linux-2.4.21-rc3/arch/sparc64/config.in
--- linux-2.4.21-rc3-nossp/arch/sparc64/config.in	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc64/config.in	2003-05-26 12:53:15.000000000 -0400
@@ -16,6 +16,9 @@
    bool '  Set version information on all symbols for modules' CONFIG_MODVERSIONS
    bool '  Kernel module loader' CONFIG_KMOD
 fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
 endmenu
 
 mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/include/linux/kernel.h linux-2.4.21-rc3/include/linux/kernel.h
--- linux-2.4.21-rc3-nossp/include/linux/kernel.h	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/include/linux/kernel.h	2003-05-26 12:13:53.000000000 -0400
@@ -86,6 +86,9 @@
 extern void dev_probe_lock(void);
 extern void dev_probe_unlock(void);
 
+extern int __guard;
+extern void __stack_smash_handler(int, char []);
+
 extern int session_of_pgrp(int pgrp);
 
 asmlinkage int printk(const char * fmt, ...)
diff -urN linux-2.4.21-rc3-nossp/kernel/ksyms.c linux-2.4.21-rc3/kernel/ksyms.c
--- linux-2.4.21-rc3-nossp/kernel/ksyms.c	2003-05-26 13:56:57.000000000 -0400
+++ linux-2.4.21-rc3/kernel/ksyms.c	2003-05-26 00:11:28.000000000 -0400
@@ -506,6 +506,8 @@
 EXPORT_SYMBOL(seq_release);
 EXPORT_SYMBOL(seq_read);
 EXPORT_SYMBOL(seq_lseek);
+EXPORT_SYMBOL_NOVERS(__guard);
+EXPORT_SYMBOL_NOVERS(__stack_smash_handler);
 
 /* Program loader interfaces */
 EXPORT_SYMBOL(setup_arg_pages);
diff -urN linux-2.4.21-rc3-nossp/lib/Makefile linux-2.4.21-rc3/lib/Makefile
--- linux-2.4.21-rc3-nossp/lib/Makefile	2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/lib/Makefile	2003-05-26 00:11:28.000000000 -0400
@@ -11,7 +11,7 @@
 export-objs := cmdline.o dec_and_lock.o rwsem-spinlock.o rwsem.o rbtree.o
 
 obj-y := errno.o ctype.o string.o vsprintf.o brlock.o cmdline.o \
-	 bust_spinlocks.o rbtree.o dump_stack.o
+	 bust_spinlocks.o rbtree.o dump_stack.o propolice.o
 
 obj-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o
 obj-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
diff -urN linux-2.4.21-rc3-nossp/lib/propolice.c linux-2.4.21-rc3/lib/propolice.c
--- linux-2.4.21-rc3-nossp/lib/propolice.c	1969-12-31 19:00:00.000000000 -0500
+++ linux-2.4.21-rc3/lib/propolice.c	2003-05-26 00:11:28.000000000 -0400
@@ -0,0 +1,13 @@
+ /*
+  *  linux/lib/errno.c
+  *
+  *
+  */
+ 
+ int __guard = '\0\0\n\777';
+ 
+ void __stack_smash_handler (int damaged, char func[])
+ 	 {
+	   static char *message = "propolice detects %x at function %s.\n" ;
+	   panic (message, damaged, func);
+}
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.