Re: Is this the ultimate stack-smash fix?

[Jeremy Jackson <jeremy.jackson@sympatico.ca>]

"Eric W. Biederman" wrote:

> Jeremy Jackson <jeremy.jackson@sympatico.ca> writes:
>
> > "Eric W. Biederman" wrote

> No.  I'm not talking about stack-guard patches.  I'm talking about bounds checking.

Sorry, I was quite incoherent.  Many others have pointed out that there exist
patches for non-executatble stack, and the problems with it. That's what I meant to
comment on.  But I'm glad to find out about bounds checking as an option.

> But the gcc bounds checking work is the ultimate buffer overflow fix.
> You can recompile all of your trusted applications, and libraries with
> it and be safe from one source of bugs.

That's why I was wondering of limiting privileged addresses security at a more
fundamental level... as you say above,
this fixes *ONE* source of bugs(security threats)... but itn't it inevitable that
there will be others?  But if services are each put
in a separate box, that doesn't have a door leading to the inner sanctum, things would
be more secure in spite of "bugs".

Well I thank everyone for their responses in this thread, I think It's been beaten
into the ground (my original idea),
and I'm left with some food for thought.