Re: Secure Linux From Scratch

On Saturday 20 December 2003 23:43, ashes wrote:
> I merged propolice.txt into winter.txt. Don't know what else to call it.
> SYNOPSIS:       ProPolice + Libsafe + Pax + PIE
> New hint and patches are on
> ftp://twocents.mooo.com/pub/

Just went through it.....

Nice. Couple of points though. It should be noted that Libsafe and ProPolice 
both protect from buffer overflows. Thus there rises a question of why we 
install both. Answer comes: Build statically a sample exploit without 
-fstack-protector and see it seg fault even when libsafe is present. Do it 
with -fstack-protector and it will *not* fail. Magic!!

There should be added format string attacks to prove even more the necessity 
for libsafe. I am currently working on some exploits to provide.

Is it wise to use cvs (i.e. non officially stable) versions to build hardened 
systems? IMO no but if you know things to be different in case of binutils I 
rest my case. For glibc things are a bit more compicated since from what it 
seems no more tarballs will be released. Opinions on this?

-- 
himicos
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page