Re: Secure Linux From Scratch

On December 23, 2003 05:23 pm, Christos Gioran wrote:
> On Saturday 20 December 2003 23:43, ashes wrote:
> > I merged propolice.txt into winter.txt. Don't know what else to call it.
> > SYNOPSIS:       ProPolice + Libsafe + Pax + PIE
> > New hint and patches are on
> > ftp://twocents.mooo.com/pub/
>
> Just went through it.....
>
> Nice. Couple of points though. It should be noted that Libsafe and
> ProPolice both protect from buffer overflows. Thus there rises a question
> of why we install both. Answer comes: Build statically a sample exploit
> without -fstack-protector and see it seg fault even when libsafe is
> present. Do it with -fstack-protector and it will *not* fail. Magic!!
>
> There should be added format string attacks to prove even more the
> necessity for libsafe. I am currently working on some exploits to provide.
>
> Is it wise to use cvs (i.e. non officially stable) versions to build
> hardened systems? IMO no but if you know things to be different in case of
> binutils I rest my case. For glibc things are a bit more compicated since
> from what it seems no more tarballs will be released. Opinions on this?
>
> --
> himicos

Libsafe and Propolice protect in completely different ways. Libsafe doesn't 
cost anything in preformance so I figured why not use it. winter.txt is 
anything but stable, it should be posible to use glibc-2.3.2 by adding two 
objects from Pax's site, I'm trying that right now. I'm trying to use 
whatever will work properly, but without downgrading to gcc-3.2. LFS-cvs is 
using a few newer packages, which are likely more secure then the ones from 
the 5.0 book. I would also like to note patch-2.5.9 is available in some 
places. I know the winter.txt needs more content and better tests, its public 
domain, so if you have additions feel free to add your name and submit 
changes, otherwise I'll get around to it.


-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page