Searched hist:e06b8b98 (Results 1 - 1 of 1) sorted by relevance
| /linux-master/ | ||
| H A D | Makefile | diff e06b8b98 Wed Feb 13 14:43:28 MST 2008 Sam Ravnborg <sam@ravnborg.org> kbuild: allow -fstack-protector to take effect Arjan van de Ven <arjan@infradead.org> wrote: === I just read the excellent LWN writeup of the vmsplice security thing, and that got me wondering why this attack wasn't stopped by the CONFIG_CC_STACKPROTECTOR option... because it plain should have been... Some analysis later.. it turns out that the following line in the top level Makefile, added by you in October 2007, entirely disables CONFIG_CC_STACKPROTECTOR ;( With this line removed the exploit will be nicely stopped. CFLAGS += $(call cc-option, -fno-stack-protector) Now I realize that certain distros have patched gcc to compensate for their lack of distro wide CFLAGS, and it's great to work around that... but would there be a way to NOT disable this for CONFIG_CC_STACKPROTECTOR please? It would have made this exploit not possible for those kernels that enable this feature (and that includes distros like Fedora) === Move the assignment to KBUILD_CFLAGS up before including the arch specific Makefile so arch makefiles may override the setting. Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Cc: Arjan van de Ven <arjan@infradead.org> Cc: stable@kernel.org diff e06b8b98 Wed Feb 13 14:43:28 MST 2008 Sam Ravnborg <sam@ravnborg.org> kbuild: allow -fstack-protector to take effect Arjan van de Ven <arjan@infradead.org> wrote: === I just read the excellent LWN writeup of the vmsplice security thing, and that got me wondering why this attack wasn't stopped by the CONFIG_CC_STACKPROTECTOR option... because it plain should have been... Some analysis later.. it turns out that the following line in the top level Makefile, added by you in October 2007, entirely disables CONFIG_CC_STACKPROTECTOR ;( With this line removed the exploit will be nicely stopped. CFLAGS += $(call cc-option, -fno-stack-protector) Now I realize that certain distros have patched gcc to compensate for their lack of distro wide CFLAGS, and it's great to work around that... but would there be a way to NOT disable this for CONFIG_CC_STACKPROTECTOR please? It would have made this exploit not possible for those kernels that enable this feature (and that includes distros like Fedora) === Move the assignment to KBUILD_CFLAGS up before including the arch specific Makefile so arch makefiles may override the setting. Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Cc: Arjan van de Ven <arjan@infradead.org> Cc: stable@kernel.org |
Completed in 1421 milliseconds