Re: Secure Linux From Scratch
Jonas Norlander <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Message-ID | <[email protected]> |
ashes wrote: > I have been actively developing a hardened Linux from Scratch for about a > month or two. I have propolice, gcc-3.4's -pie backport, which takes advatage > of the Pax kernel patch for randomized memory address space, and the entire > LFS system builds with both protections with the exception of the kernel > itself, and grub. I have successfuly compiled my LFS 5.0 system including the kernel except grub with the propolice patch. I used the attached patch on kernel 2.4.22 to make it compile with propolice. Perhaps anyone with more knowledge can modifie it for 2.4.23 and submit it to the pathlist? > Adding a read only encrypted filesystem would be trivial. > Building a trusted system takes a trusted host system. In my opinion it would > take two simutainious LFS builds to construct a trusted system (trusted by > us). If there is enough interest in designing a Secure LFS book count me in. > We will need some sort of website and maybe a seperate mailing list. More > importantly we need a security policy for the design. What I consider > important to security maybe isn't what others think. I have also been doing > some light auditing, the grades depend on version of the software. For > example coreutils-5.0.91 software was less submissive to attack then > coreutils-5.0 (using bfbtester). I am not too impressed with selinux, it's > policies are not manditory; the attacker just needs to exploit a protocol not > recognised by selinux, such as ipv6 (who knows what else). > I would also like to note there are countless "secure" linux implementations, > and if we are to start a new one it better be good or its not worth doing. In > most, if not all, distributions, security is sacrificed for marketing and > user friendlyness. I dont mean this as a rant, but more as the truth, systems > like debain, gentoo, redhat, and even openbsd, care more about the money in > their pocket then the quality of the system they ship. I hope this is where > LFS is different since its not marketed for the masses. > Security starts with the toolchain, and no software is exempt from audit. > > Sorry for the late follow up. > -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page
2.4.20-propolice-build.patch
(text/plain, 8.9 KB)
diff -urN linux-2.4.21-rc3-nossp/arch/alpha/Makefile linux-2.4.21-rc3/arch/alpha/Makefile
--- linux-2.4.21-rc3-nossp/arch/alpha/Makefile 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/alpha/Makefile 2003-05-26 12:52:53.000000000 -0400
@@ -84,6 +84,10 @@
endif
CFLAGS := $(CFLAGS) -Wa,-mev6
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
HEAD := arch/alpha/kernel/head.o
SUBDIRS := $(SUBDIRS) arch/alpha/kernel arch/alpha/mm arch/alpha/lib \
diff -urN linux-2.4.21-rc3-nossp/arch/alpha/config.in linux-2.4.21-rc3/arch/alpha/config.in
--- linux-2.4.21-rc3-nossp/arch/alpha/config.in 2003-05-26 13:56:38.000000000 -0400
+++ linux-2.4.21-rc3/arch/alpha/config.in 2003-05-26 12:52:16.000000000 -0400
@@ -22,6 +22,9 @@
bool 'Set version information on all symbols for modules' CONFIG_MODVERSIONS
bool 'Kernel module loader' CONFIG_KMOD
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/i386/Makefile linux-2.4.21-rc3/arch/i386/Makefile
--- linux-2.4.21-rc3-nossp/arch/i386/Makefile 2003-05-26 13:56:39.000000000 -0400
+++ linux-2.4.21-rc3/arch/i386/Makefile 2003-05-26 12:10:48.000000000 -0400
@@ -94,6 +94,10 @@
CFLAGS += $(call check_gcc,-march=c3-2,-march=i686)
endif
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
HEAD := arch/i386/kernel/head.o arch/i386/kernel/init_task.o
SUBDIRS += arch/i386/kernel arch/i386/mm arch/i386/lib
diff -urN linux-2.4.21-rc3-nossp/arch/i386/config.in linux-2.4.21-rc3/arch/i386/config.in
--- linux-2.4.21-rc3-nossp/arch/i386/config.in 2003-05-26 13:56:39.000000000 -0400
+++ linux-2.4.21-rc3/arch/i386/config.in 2003-05-26 12:45:53.000000000 -0400
@@ -256,6 +256,9 @@
if [ "$CONFIG_SMP" = "y" -a "$CONFIG_X86_CMPXCHG" = "y" ]; then
define_bool CONFIG_HAVE_DEC_LOCK y
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/m68k/Makefile linux-2.4.21-rc3/arch/m68k/Makefile
--- linux-2.4.21-rc3-nossp/arch/m68k/Makefile 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/m68k/Makefile 2003-05-26 12:51:45.000000000 -0400
@@ -54,6 +54,10 @@
CFLAGS := $(subst -fomit-frame-pointer,,$(CFLAGS)) -g
endif
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
ifndef CONFIG_SUN3
HEAD := arch/m68k/kernel/head.o
else
diff -urN linux-2.4.21-rc3-nossp/arch/m68k/config.in linux-2.4.21-rc3/arch/m68k/config.in
--- linux-2.4.21-rc3-nossp/arch/m68k/config.in 2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/m68k/config.in 2003-05-26 12:51:17.000000000 -0400
@@ -83,6 +83,9 @@
bool 'Use write-through caching for 68060 supervisor accesses' CONFIG_060_WRITETHROUGH
fi
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/mips/Makefile linux-2.4.21-rc3/arch/mips/Makefile
--- linux-2.4.21-rc3-nossp/arch/mips/Makefile 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/mips/Makefile 2003-05-26 12:50:52.000000000 -0400
@@ -98,6 +98,9 @@
AFLAGS += $(GCCFLAGS)
CFLAGS += $(GCCFLAGS)
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
#
# We unconditionally build the math emulator
diff -urN linux-2.4.21-rc3-nossp/arch/mips/config-shared.in linux-2.4.21-rc3/arch/mips/config-shared.in
--- linux-2.4.21-rc3-nossp/arch/mips/config-shared.in 2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/mips/config-shared.in 2003-05-26 12:50:04.000000000 -0400
@@ -545,6 +545,9 @@
else
define_bool CONFIG_CPU_HAS_SYNC y
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/ppc/Makefile linux-2.4.21-rc3/arch/ppc/Makefile
--- linux-2.4.21-rc3-nossp/arch/ppc/Makefile 2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/ppc/Makefile 2003-05-26 12:44:19.000000000 -0400
@@ -46,6 +46,10 @@
CFLAGS += $(shell echo $(CONFIG_COMPILE_OPTIONS) | sed -e 's/"//g')
endif
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
ifdef CONFIG_4xx
HEAD := arch/ppc/kernel/head_4xx.o
else
diff -urN linux-2.4.21-rc3-nossp/arch/ppc/config.in linux-2.4.21-rc3/arch/ppc/config.in
--- linux-2.4.21-rc3-nossp/arch/ppc/config.in 2003-05-26 13:56:40.000000000 -0400
+++ linux-2.4.21-rc3/arch/ppc/config.in 2003-05-26 12:47:22.000000000 -0400
@@ -141,6 +141,9 @@
if [ "$CONFIG_8xx" = "y" -o "$CONFIG_8260" = "y" ]; then
define_bool CONFIG_EMBEDDEDBOOT y
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/sparc/Makefile linux-2.4.21-rc3/arch/sparc/Makefile
--- linux-2.4.21-rc3-nossp/arch/sparc/Makefile 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc/Makefile 2003-05-26 12:48:42.000000000 -0400
@@ -30,6 +30,10 @@
CFLAGS := $(CFLAGS) -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
endif
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
#LINKFLAGS = -N -Ttext 0xf0004000
LINKFLAGS = -T arch/sparc/vmlinux.lds
diff -urN linux-2.4.21-rc3-nossp/arch/sparc/config.in linux-2.4.21-rc3/arch/sparc/config.in
--- linux-2.4.21-rc3-nossp/arch/sparc/config.in 2003-05-26 13:56:43.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc/config.in 2003-05-26 12:47:34.000000000 -0400
@@ -19,6 +19,9 @@
bool ' Set version information on all symbols for modules' CONFIG_MODVERSIONS
bool ' Kernel module loader' CONFIG_KMOD
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/arch/sparc64/Makefile linux-2.4.21-rc3/arch/sparc64/Makefile
--- linux-2.4.21-rc3-nossp/arch/sparc64/Makefile 2003-05-26 13:56:43.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc64/Makefile 2003-05-26 12:53:36.000000000 -0400
@@ -58,6 +58,10 @@
CFLAGS := $(CFLAGS) -pg
endif
+ifdef CONFIG_PROPOLICE
+CFLAGS += -fstack-protector
+endif
+
LINKFLAGS = -T arch/sparc64/vmlinux.lds
HEAD := arch/sparc64/kernel/head.o arch/sparc64/kernel/init_task.o
diff -urN linux-2.4.21-rc3-nossp/arch/sparc64/config.in linux-2.4.21-rc3/arch/sparc64/config.in
--- linux-2.4.21-rc3-nossp/arch/sparc64/config.in 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/arch/sparc64/config.in 2003-05-26 12:53:15.000000000 -0400
@@ -16,6 +16,9 @@
bool ' Set version information on all symbols for modules' CONFIG_MODVERSIONS
bool ' Kernel module loader' CONFIG_KMOD
fi
+
+# ProPolice build support (add -fstack-protector)
+bool ' ProPolice stack smashing protection' CONFIG_PROPOLICE
endmenu
mainmenu_option next_comment
diff -urN linux-2.4.21-rc3-nossp/include/linux/kernel.h linux-2.4.21-rc3/include/linux/kernel.h
--- linux-2.4.21-rc3-nossp/include/linux/kernel.h 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/include/linux/kernel.h 2003-05-26 12:13:53.000000000 -0400
@@ -86,6 +86,9 @@
extern void dev_probe_lock(void);
extern void dev_probe_unlock(void);
+extern int __guard;
+extern void __stack_smash_handler(int, char []);
+
extern int session_of_pgrp(int pgrp);
asmlinkage int printk(const char * fmt, ...)
diff -urN linux-2.4.21-rc3-nossp/kernel/ksyms.c linux-2.4.21-rc3/kernel/ksyms.c
--- linux-2.4.21-rc3-nossp/kernel/ksyms.c 2003-05-26 13:56:57.000000000 -0400
+++ linux-2.4.21-rc3/kernel/ksyms.c 2003-05-26 00:11:28.000000000 -0400
@@ -506,6 +506,8 @@
EXPORT_SYMBOL(seq_release);
EXPORT_SYMBOL(seq_read);
EXPORT_SYMBOL(seq_lseek);
+EXPORT_SYMBOL_NOVERS(__guard);
+EXPORT_SYMBOL_NOVERS(__stack_smash_handler);
/* Program loader interfaces */
EXPORT_SYMBOL(setup_arg_pages);
diff -urN linux-2.4.21-rc3-nossp/lib/Makefile linux-2.4.21-rc3/lib/Makefile
--- linux-2.4.21-rc3-nossp/lib/Makefile 2003-05-26 13:04:24.000000000 -0400
+++ linux-2.4.21-rc3/lib/Makefile 2003-05-26 00:11:28.000000000 -0400
@@ -11,7 +11,7 @@
export-objs := cmdline.o dec_and_lock.o rwsem-spinlock.o rwsem.o rbtree.o
obj-y := errno.o ctype.o string.o vsprintf.o brlock.o cmdline.o \
- bust_spinlocks.o rbtree.o dump_stack.o
+ bust_spinlocks.o rbtree.o dump_stack.o propolice.o
obj-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o
obj-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
diff -urN linux-2.4.21-rc3-nossp/lib/propolice.c linux-2.4.21-rc3/lib/propolice.c
--- linux-2.4.21-rc3-nossp/lib/propolice.c 1969-12-31 19:00:00.000000000 -0500
+++ linux-2.4.21-rc3/lib/propolice.c 2003-05-26 00:11:28.000000000 -0400
@@ -0,0 +1,13 @@
+ /*
+ * linux/lib/errno.c
+ *
+ *
+ */
+
+ int __guard = '\0\0\n\777';
+
+ void __stack_smash_handler (int damaged, char func[])
+ {
+ static char *message = "propolice detects %x at function %s.\n" ;
+ panic (message, damaged, func);
+}