From: John Richard Moser <nigelenki@comcast.net>
To: linux-kernel@vger.kernel.org
Subject: The __KERNEL__ #define
Date: Sat, 04 Dec 2004 18:23:14 -0500 [thread overview]
Message-ID: <41B246E2.7070501@comcast.net> (raw)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Recently there has been talk of splitting up include/linux to obsolete
the __KERNEL__ define. I would like to request that __KERNEL__ remain
defined in the kernel build process and in module building.
A modified specs file on Gentoo enables -fstack-protector{,-all} in gcc,
two switches added by a patch[1][2] to gcc made by Etoh and Yoda of the
IBM Tokyo Research Labs. This patch relies on several symbols not
defined in the kernel to do a type of artificial bounds checking,
preventing stack-based buffer overflows from being utilized in security
exploits. It was determined that this is non-useful in the kernel
(although possibly more research should be done-- is it worth it to
panic when we think there's a kernel-level exploit occuring?), and so
the specs file does not enable these if __KERNEL__ is defined.
The specs file also generates PIE-by-default executables, and disables
this functionality if __KERNEL__ is defined; so if it is determined that
~ SSP in the kernel would be useful, this define is still needed. In
general it is in itself harmless and should stay as an indicator.
The Hardened Debian project is going to implement a similar specs file
alteration, which may be used in Ubuntu and Debian.
[1] trl.ibm.com/projects/security/ssp/
[2] trl.ibm.com/projects/security/ssp/main.html (paper)
- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFBskbihDd4aOud5P8RAqfyAJwKY9Krn8e8JFBNixlGRkFae9L7XACfQ/AV
x7AtknAzLTVjfuOQjUE1IWs=
=qx1O
-----END PGP SIGNATURE-----
reply other threads:[~2004-12-04 23:23 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=41B246E2.7070501@comcast.net \
--to=nigelenki@comcast.net \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox