Re: Linux kernel proactive security hardening

[Vasiliy Kulikov <segoon () openwall com>]

Solar,

On Mon, Nov 08, 2010 at 08:48 +0300, Solar Designer wrote:
> 2. We could turn all function-local non-static definitions of:
>
> struct x y;
>
> into:
>
> struct x y = {};
>
> We could do this by pre-processing the source files

With coccinelle it is trivial:

@@
identifier T, x, f;
@@

f(...)
{
 ...
 struct T x
+ = {}
 ;
 ...
}

However, I don't think that all linux maintainers would be happy with
this.

> or with a patch to
> gcc (introduce a command-line option to assume empty initializers for
> all on-stack structs).

IMO much better solution - instead of many MB trivial patch have small
gcc patch.


Thanks,

-- 
Vasiliy