lkml.org 
[lkml]   [2008]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 34/38] kbuild: allow -fstack-protector to take effect
On Fri, 22 Feb 2008 16:31:33 -0800
Greg KH <gregkh@suse.de> wrote:

> 2.6.24-stable review patch. If anyone has any objections, please let
> us know.


not ready for -stable yet. if ever for backporting (doubtful)

>
> ------------------
> From: Sam Ravnborg <sam@ravnborg.org>
>
> commit: e06b8b98da071f7dd78fb7822991694288047df0
>
> Arjan van de Ven <arjan@infradead.org> wrote:
> ===
> I just read the excellent LWN writeup of the vmsplice
> security thing, and that got me wondering why this attack
> wasn't stopped by the CONFIG_CC_STACKPROTECTOR option...
> because it plain should have been...
>
> Some analysis later.. it turns out that the following line
> in the top level Makefile, added by you in October 2007,
> entirely disables CONFIG_CC_STACKPROTECTOR ;(
> With this line removed the exploit will be nicely stopped.
>
> CFLAGS += $(call cc-option, -fno-stack-protector)
>
> Now I realize that certain distros have patched gcc to
> compensate for their lack of distro wide CFLAGS, and it's
> great to work around that... but would there be a way to NOT
> disable this for CONFIG_CC_STACKPROTECTOR please?
> It would have made this exploit not possible for those kernels
> that enable this feature (and that includes distros like Fedora)
> ===
>
> Move the assignment to KBUILD_CFLAGS up before including
> the arch specific Makefile so arch makefiles may override
> the setting.
>
> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
> Cc: Arjan van de Ven <arjan@infradead.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
> ---
> Makefile | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> --- a/Makefile
> +++ b/Makefile
> @@ -507,6 +507,10 @@ else
> KBUILD_CFLAGS += -O2
> endif
>
> +# Force gcc to behave correct even for buggy distributions
> +# Arch Makefiles may override this setting
> +KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
> +
> include $(srctree)/arch/$(SRCARCH)/Makefile
>
> ifdef CONFIG_FRAME_POINTER
> @@ -520,9 +524,6 @@ KBUILD_CFLAGS += -g
> KBUILD_AFLAGS += -gdwarf-2
> endif
>
> -# Force gcc to behave correct even for buggy distributions
> -KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
> -
> # arch Makefile may override CC so keep this after arch Makefile is
> included NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC)
> -print-file-name=include) CHECKFLAGS += $(NOSTDINC_FLAGS)
>


--
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings,
visit http://www.lesswatts.org


\
 
 \ /
  Last update: 2008-02-23 01:57    [W:0.171 / U:0.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site