From mboxrd@z Thu Jan  1 00:00:00 1970
From: Joshua Branson <jbranso@fastmail.com>
Subject: Re: hardening
Date: Mon, 29 Jan 2018 11:21:33 -0800
Message-ID: <1517253693.1849044.1252215808.688B23B5@webmail.messagingengine.com>
References: <87a7wwesx2.fsf@abyayala.i-did-not-set--mail-host-address--so-tickle-me>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48344)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jbranso@fastmail.com>) id 1egEzr-0002ih-BP
	for guix-devel@gnu.org; Mon, 29 Jan 2018 14:21:40 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jbranso@fastmail.com>) id 1egEzm-0003mO-VQ
	for guix-devel@gnu.org; Mon, 29 Jan 2018 14:21:39 -0500
Received: from out3-smtp.messagingengine.com ([66.111.4.27]:54713)
	by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
	(Exim 4.71) (envelope-from <jbranso@fastmail.com>)
	id 1egEzm-0003lG-MJ
	for guix-devel@gnu.org; Mon, 29 Jan 2018 14:21:34 -0500
Received: from compute6.internal (compute6.nyi.internal [10.202.2.46])
	by mailout.nyi.internal (Postfix) with ESMTP id D6E0121249
	for <guix-devel@gnu.org>; Mon, 29 Jan 2018 14:21:33 -0500 (EST)
In-Reply-To: <87a7wwesx2.fsf@abyayala.i-did-not-set--mail-host-address--so-tickle-me>
List-Id: "Development of GNU Guix and the GNU System distribution."
	<guix-devel.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/guix-devel>,
	<mailto:guix-devel-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/guix-devel/>
List-Post: <mailto:guix-devel@gnu.org>
List-Help: <mailto:guix-devel-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/guix-devel>,
	<mailto:guix-devel-request@gnu.org?subject=subscribe>
Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org
Sender: "Guix-devel" <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
To: guix-devel@gnu.org

Is this something anyone can start using now?  Like I can modify my config.scm file somehow and start enjoying a hardened guix?

On Mon, Jan 29, 2018, at 4:44 AM, ng0@n0.is wrote:
> Hi,
> 
> as we've long talked and not really taken action on hardening builds
> I've started working on an opt-in way as last discussed in
> september 2016, modifying the gnu-build-system with a
> #:hardening-flags keyword.
> 
> For my testing purposes I will use
> 
> > CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> 
> which is used by Gentoo, but adjustments (wether to opt-in or
> opt-out) will be made.
> -- 
> ng0 :: https://ea.n0.is
> A88C8ADD129828D7EAC02E52E22F9BBFEE348588 :: https://ea.n0.is/keys/
>