-fpie or ssp (IBM stack hardening)

-fpie or ssp (IBM stack hardening)

[B.G. Bruce]

Has anyone looked into how compatible XEN is with pie (-fpie) or ssp?

Regards,
B.


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click

Re: -fpie or ssp (IBM stack hardening)

[Jerome Brown]

B.G. Bruce wrote:
> Has anyone looked into how compatible XEN is with pie (-fpie) or ssp?

>From memory (it has been a while since I have tried due to xorg issues)
Xen itself _will_ compile and run with ssp and pie. However the kernel
will not (this is a standard kernel 'feature' - as mentioned previously
on this list it is probably better that it doesn't).

HTH

-- 
Jerome Brown
Technology Architect
Hub.Net

P: +64  3 961-5116
M: +64 29 453 7663
F: +64  3 961-5129
E: jerome@hub.net.nz
W: http://www.hub.net.nz/
O: Level 4, 818 Colombo St, Christchurch, New Zealand
S: PO Box 1879, Christchurch, New Zealand


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click

Re: -fpie or ssp (IBM stack hardening)

[voices]

Jerome Brown wrote:
> B.G. Bruce wrote:
> 
>>Has anyone looked into how compatible XEN is with pie (-fpie) or ssp?
> 

Yes, I've tried it on gentoo-hardened with PIE(ET_DYN)/SSP.
I works without any problems.

But .. Is there any other purpose in compiling the system as PIE, other 
than for using PaX ?

Unfortunately, nobody is porting PaX to XEN ... very bad, especially if 
we're talking about secure systems.

Lack of PaX for XEN prevents me from using xen on my servers.

-- 
voices (at) metallicrain (dot) com



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click