Date: Tue, 12 Feb 2008 11:08:18 -0800
From: Arjan van de Ven <arjan@infradead.org>
To: Sam Ravnborg <sam@ravnborg.org>
Cc: linux-kernel@vger.kernel.org, mingo@elte.hu, torvalds@linux-foundation.org
Subject: Re: vmsplice exploits, stack protector and Makefiles
Message-ID: <20080212110818.62496cf4@laptopd505.fenrus.org>
In-Reply-To: <20080212185012.GA2348@uranus.ravnborg.org>
References: <20080212090001.3fcc4ca0@laptopd505.fenrus.org>
	<20080212185012.GA2348@uranus.ravnborg.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1171
Lines: 27

On Tue, 12 Feb 2008 19:50:12 +0100
Sam Ravnborg <sam@ravnborg.org> wrote:
> > 
> > Now I realize that certain distros have patched gcc to compensate
> > for their lack of distro wide CFLAGS, and it's great to work around
> > that... but would there be a way to NOT disable this for
> > CONFIG_CC_STACKPROTECTOR please? It would have made this exploit
> > not possible for those kernels that enable this feature (and that
> > includes distros like Fedora)
> 
> I guess the problem is that we in arch/x86/Makefile enable the
> stackprotector but then later in the main Makefile disables it.
> So the right way to approach this should be to always disable it and
> the reenable it in the arch Makefile.
> So something like this?


the patch works fine for me.
Linus, can we please get this merged into .25? it will at least
again limit the damage exploits like the vmsplice one can do..

(I think it's also worth it for -stable)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/