Re: Secure Linux From Scratch

On Tuesday 16 December 2003 04:51 pm, Christos Gioran wrote:
> On Tuesday 16 December 2003 19:01, ashes wrote:
> > On Tuesday 16 December 2003 11:20 am, Christos Gioran wrote:
> > > Another problem: I started building a LFS with the host system being a
> > > LFS with the propolice patch. GCC pass 1 fails complaining about
> > > unresolved symbols in some stack_smashing related function. If i do not
> > > apply the relevant propolice patch it does go on. Could this be a bug
> > > in propolice patches? Or should I RTFM more closely?
> >
> > I've never seen an error from propolice in gcc pass 1. Paste the errors
> > here if you get a chance, or otherwise send them to me. Just to note in
> > gcc pass 1 do _not_ use -fstack-protector or the protector_only patch.
> > Because gcc is built static and glibc isn't patched for it at that stage.
> > However when I did my initial testing, using propolice_only in gcc pass
> > 1, I still didn't get any errors from make.
>
> Now it makes sence. My host system gcc is patched with propolice_only. This
> must be what breaks it. After I finish the libsafe stuff I will try
> building with the -fno-stack-protector CFLAG. Will get back with more info.
>
> himicos

If the host system has propolice_only and the glibc patch, like if this is the 
second build, then you can use the propolice_only patch in gcc pass 1, 
because glibc-propolice would build the static gcc properly.

I can see how you would get symbol errors if you had gcc-protector_only on the 
host, building gcc-protector, in which you would need CFLAGS and CXXFLAGS 
with -fno-stack-protector if you want to downgrade to the standard gcc.
This is because the first gcc will be built with propolice, and the following 
gcc's durring the bootstrap will not, so they wont match.

Again, if the host is running gcc-protector_only, then the protector_only 
patch should be used in gcc pass 1. Maybe this should be mentioned in the 
hint.
This will also be an issue for people going from the newer gentoo, redhat, or 
other systems with default -fstack-protector.


-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page