cvs commit: hints propolice.txt

tushar at tushar at
Fri Jan 16 19:30:02 PST 2004

tushar      04/01/16 20:30:02

  Modified:    .        propolice.txt
  Updated propolice.txt
  Revision  Changes    Path
  1.11      +73 -14    hints/propolice.txt
  Index: propolice.txt
  RCS file: /home/cvsroot/hints/propolice.txt,v
  retrieving revision 1.10
  retrieving revision 1.11
  diff -u -u -r1.10 -r1.11
  --- propolice.txt	17 Jan 2004 03:28:56 -0000	1.10
  +++ propolice.txt	17 Jan 2004 03:30:02 -0000	1.11
  @@ -24,6 +24,7 @@
   		ProPolice in Glibc vs GCC
   		CFLAGS and ProPolice
   		ProPolice bugs
  +		Hardened GCC
  @@ -34,6 +35,8 @@
  +This whole hint is experimental.
   ProPolice Smashing Stack Protector
   -The good news:
  @@ -78,16 +81,31 @@
   -fstack-protector-all protects all functions regardless of array size, while
   -fstack-protector does not protect arrays of length seven or less. ProPolice
   often triggers bugs in software, -fstack-protector-all causes even more. The
  -only bugs I have noticed so far have been with XFree86 and tool chain test
  +only serious bugs I have noticed so far have been with XFree86 and tool chain test
   suites. The patch for X makes use of OpenBSD code in XFree86 so it builds with
  -ProPolice. Gentoo has also developed a script that will change the GCC spec
  -file, and a link is in the acknowledgments. The Glibc method causes more errors
  -in general. Adding -fstack-protector-all to your cflags is encouraged, but right
  +ProPolice. Adding -fstack-protector-all to your cflags is encouraged, but right
   now I know it will cause yet more errors.
  +Hardened GCC
  +Gentoo developers have created a shell script which edits the GCC spec file for
  +us. This makes ProPolice easier to use, and adds et_dyn. Their source include
  +crt1S.S which is distributed by PaX to make use of et_dyn in Glibc-2.3.2.
  +Glibc-2.3.3 has intergrated this feature. I have taken the Gentoo source for
  +sys-devel/hardened-gcc and adapted it for LFS. I basicly only changed "ewarn" to
  +"echo" and /usr to /tools, where it was needed. However this doesn't end.
  +Gentoo's newest hardened-gcc depends on gcc-config (another Gentoo script), and
  +Python. So hopefully one of us will be able to rewrite this script in the future
  +to drop the Python dependency. This script won't disable the protector_only patch,
  +so don't use it. You will need sed-4.x on your host. And binutils that understands
  +-pie to use et_dyn.
   ProPolice bugs
  +I have ways of making most of these go away.
   FAIL: bootstrap with --static
   FAIL: S-records
  @@ -165,6 +183,11 @@ \
  +Hardened GCC
  @@ -206,28 +229,62 @@
    - GCC pass 2
   You could get some errors from the tests. More for for the using Glibc method.
  -patch -Np1 -i ../gcc-3.3.1-protector_only-3.patch
  - - Binutils
  -This command will get rid of make check errors if you are using the GCC method.
  -For some reason the errors don't go away with the Glibc method.
  -make CFLAGS="-fno-stack-protector -O2" CXXFLAGS="-fno-stack-protector -O2" check
  +Don't worry too much about errors here, you'll get fewer after hcc is installed.
  +patch -Np1 -i ../gcc-3.3.1-protector-3.patch
  + - HLFS GCC
  +Note: crt1S.S can be edited for a specific kernel version. I used 2.4.1 as the
  +min version number.
  +cp /tools/lib/gcc-lib/i686-pc-linux-gnu/3.3.1/specs ~/
  +cp chapter5/hardened-gcc-* /tools/bin
  +cp chapter5/hcc.conf /tools/etc
  +ln -s /tools/bin/hcc
  +cd glibc-2.3.2 && make
  +cp crt1S.o /tools/lib
  +hcc -a
  + - Binutils pass 2
  +The only way to make this stable is by using `hcc -r` before make. The best I
  +could do still produced "FAIL: bootstrap with --static". Untill this is fixed I
  +do not reccomend building binutils with propolice.
  +hcc -a should work fine for the rest of the chapter.
  +Don't forget to install m4, bison, and flex to /tools if you're using HJL binutils
  +for et_dyn.
   Chapter 6
    - Glibc
  -No errors from make check.
  +No errors from make check. hcc -a just to be sure.
   patch -Np1 -i ../glibc-2.3.2-propolice-guard-functions-1.patch
    - Binutils
  -make CFLAGS="-fno-stack-protector -O2" CXXFLAGS="-fno-stack-protector -O2" check
  +hcc -r
    - GCC
  -patch -Np1 -i ../gcc-3.3.2-protector_only-3.patch
  +hcc -a
  +patch -Np1 -i ../gcc-3.3.2-protector-3.patch
  +I get:
  +FAIL: gcc.dg/duff-2.c (test for excess errors)
  +FAIL: gcc.dg/uninit-C.c (test for excess errors)
  +FAIL: g++.dg/tls/init-2.C (test for excess errors)
  + - HCC GCC
  +cp /usr/lib/gcc-lib/i686-pc-linux-gnu/3.3.1/specs ~/gcc.specs
  +Never overwrite this file. This file is the only file hcc changes. Copy it back
  +if you ever have serious problems.
  +cp chapter6/hardened-gcc-* /usr/bin &&
  +cp chapter6/hcc.conf /etc &&
  +ln -s /usr/bin/hcc &&
  +cd glibc-2.3.2 && make &&
  +cp crt1S.o /usr/lib &&
  +hcc -a
    - Libsafe
  -There are test exploits in the Libsafe source you should look at.
  +All of the exploits in exploits/ will fail because of hcc. Libsafe is obsolete.
  +You can install it if you want to, it has worked fine for me with kde, etc.
   make &&
   make install
  @@ -258,6 +315,8 @@
   The purpose of these examples is not to create havoc, but instead to help anyone
   abuse their own software so they can make reports, and get them fixed, before
   they are exploited. I hope to add more general ways of testing software. 
  +These exploits are obsolete.
   ## This program overflows the stack.

More information about the hints mailing list