Date: Wed, 16 Aug 2006 20:12:47 +0200
From: Adrian Bunk <bunk@stusta.de>
To: Arjan van de Ven <arjan@linux.intel.com>
Cc: linux-kernel@vger.kernel.org, akpm@osdl.org, ak@suse.de
Subject: Re: [patch 2/5] -fstack-protector feature: Add the Kconfig option
Message-ID: <20060816181246.GE7813@stusta.de>
References: <1155746902.3023.63.camel@laptopd505.fenrus.org> <1155747038.3023.67.camel@laptopd505.fenrus.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1155747038.3023.67.camel@laptopd505.fenrus.org>
User-Agent: Mutt/1.5.12-2006-07-14
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2450
Lines: 64

On Wed, Aug 16, 2006 at 06:50:38PM +0200, Arjan van de Ven wrote:
> Subject: [patch 2/5] Add the Kconfig option for the stackprotector feature
> From: Arjan van de Ven <arjan@linux.intel.com>
> 
> This patch adds the config options for -fstack-protector.
> 
> Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
> Signed-off-by: Ingo Molnar <mingo@elte.hu>
> CC: Andi Kleen <ak@suse.de>
> 
> ---
>  arch/x86_64/Kconfig |   23 +++++++++++++++++++++++
>  1 file changed, 23 insertions(+)
> 
> Index: linux-2.6.18-rc4-stackprot/arch/x86_64/Kconfig
> ===================================================================
> --- linux-2.6.18-rc4-stackprot.orig/arch/x86_64/Kconfig
> +++ linux-2.6.18-rc4-stackprot/arch/x86_64/Kconfig
> @@ -522,6 +522,30 @@ config SECCOMP
>  
>  	  If unsure, say Y. Only embedded should say N here.
>  
> +config CC_STACKPROTECTOR
> +	bool "Enable -fstack-protector buffer overflow detection (EXPRIMENTAL)"
> +	depends on EXPERIMENTAL
> +	help
> +         This option turns on the -fstack-protector GCC feature. This
> +	  feature puts, at the beginning of critical functions, a canary
> +	  value on the stack just before the return address, and validates
> +	  the value just before actually returning.  Stack based buffer
> +	  overflows (that need to overwrite this return address) now also
> +	  overwrite the canary, which gets detected and the attack is then
> +	  neutralized via a kernel panic.
> +
> +	  This feature requires gcc version 4.2 or above, or a distribution
> +	  gcc with the feature backported. Older versions are automatically
> +	  detected and for those versions, this configuration option is ignored.
>...

Please add something like

	This feature adds some extra security with a moderate
	performance overhead.

to make it easier for a user to decide whether or not to enable this 
option.

cu
Adrian

-- 

    Gentoo kernels are 42 times more popular than SUSE kernels among
    KLive users  (a service by SUSE contractor Andrea Arcangeli that
    gathers data about kernels from many users worldwide).

       There are three kinds of lies: Lies, Damn Lies, and Statistics.
                                                    Benjamin Disraeli

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/