linux-kernel - Re: [patch core/stackprotector] stackprotector: Fix build when compiler lacks support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 1 Jan 2014 12:42:44 +0100
From:	"Yann E. MORIN" <yann.morin.1998@...e.fr>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Kees Cook <keescook@...omium.org>,
	David Rientjes <rientjes@...gle.com>,
	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Russell King - ARM Linux <linux@....linux.org.uk>,
	Ralf Baechle <ralf@...ux-mips.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Arjan van de Ven <arjan@...ux.intel.com>,
	James Hogan <james.hogan@...tec.com>,
	Michal Marek <mmarek@...e.cz>,
	Paul Mundt <lethal@...ux-sh.org>,
	Shawn Guo <shawn.guo@...aro.org>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	linux-kbuild <linux-kbuild@...r.kernel.org>,
	Sam Ravnborg <sam@...nborg.org>,
	"linux-tip-commits@...r.kernel.org" 
	<linux-tip-commits@...r.kernel.org>
Subject: Re: [patch core/stackprotector] stackprotector: Fix build when
 compiler lacks support

Linus, All,

On 2013-12-31 16:16 -0800, Linus Torvalds spake thusly:
> On Mon, Dec 30, 2013 at 4:45 PM, Kees Cook <keescook@...omium.org> wrote:
> >
> > NAK. If you have selected CONFIG_CC_STACKPROTECTOR_STRONG, the build
> > the fail hard. Without this, it means you'll end up with kernels that
> > build and show a stackprotector option in their config, which is
> > false.
> 
> What we really really want to do is to have some way to add config
> options based on shell scripts and compiler support. That would also
> get rid of a lot of Makefile trickery etc.
> 
> Then we could just make CC_STACKPROTECTOR_STRONG depend on
> CC_SUPPORTS_STACKPROTECTOR_STRONG or whatever.

Sam Ravnborg suggested somethink along those lines back in July:
    http://marc.info/?l=linux-kbuild&m=137399785206527&w=2
and a tentative implementation:
    http://marc.info/?l=linux-kbuild&m=137409581406434&w=2

Basically, that would give something like:

    config CC_SUPPORTS_STACKPROTECTOR_STRONG
        bool
        option exec="some/script/to/test-gcc -fstack-protector-strong"

    config CC_STACKPROTECTOR_STRONG
        bool "enable stack-protector strong"
        depends on CC_SUPPORTS_STACKPROTECTOR_STRONG

Would that be something that match what you suggested above?

Sam, there were some comments on that patch of yours. Do you want to
update it and resubmit it?

And, Happy New Year to All!

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/