Re: Automatic binary hardening with Autoconf

[Sebastian Krahmer <krahmer () suse de>]

On Tue, May 15, 2012 at 08:13:31AM -0400, Steve Grubb wrote:
> On Monday, May 14, 2012 09:33:14 PM Solar Designer wrote:
> > I'd like this sort of topics to be brought up in here, so I'll start by
> > referring to some blog posts.
> >
> > Here's an interesting one by Keegan McAllister:
> >
> > http://mainisusuallyafunction.blogspot.com/2012/05/automatic-binary-hardeni
> > ng-with.html
> >
> > This suggests (and shows how) individual programs that use autoconf may
> > automatically enable the usual set of compile-time hardening settings
> > that are otherwise normally provided by builds for/by/on hardened
> > distros only.  This is not rocket science, yet the provided examples may
> > be reused and it may become a trend.
>
> I think there are conflicting goals in projects like this. There are times when 
> someone may want to go all out and harden everything as much as possible. But 
> there is a cost to that...either startup or runtime. Not all programs have the 
> same threat model and consequence if attacked successfully. Apps that are at 
> greatest risk are: set[ug]id/fs based capabilities, network facing apps, 
> daemons, or parsers of untrusted media. It would be hard to argue that the "cat" 
> program needs full relro and bind now.

You never know. I'd even say that the cat gets the most untrusted input
ever. Everything and the world has been piped
through cat since epoch. And similar surprises will happen to all the
non threatening programs that are not seen as risk like file, ls, ps etc.
until one realizes that some procmail/cups or whatever filter is using it.
And then, Murphy is entering the dance floor.

Sebastian

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team

---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany