From: kiasoc5--- via "Development of GNU Guix and the GNU System distribution." <guix-devel@gnu.org>
To: Guix Devel <guix-devel@gnu.org>
Subject: Hardened toolchain
Date: Mon, 21 Mar 2022 05:31:01 +0100 (CET) [thread overview]
Message-ID: <MyejWoQ--3-2@tutanota.com> (raw)
I posted an initial message on help-guix about compiling a custom hardened gcc, but guix-devel is a better list to continue the discussion. I wanted to revisit compiling Guix packages with a hardened toolchain since many other distros do this to improve the security of their packages.
Previous emails only mentioned passing hardening options to CFLAGS and LDFLAGS. Another important step is to compile features into GCC and binutils. Specifically:
* gcc can be compiled with `--enable-default-ssp --enable-default-pie` to enforce ssp and pic
* binutils can be compiled with `--enable-relro --enable-pic` to enforce relro and pic
I'm not a toolchain expert by any means, but I think this is a good first step in improving Guix package security.
1. https://lists.archlinux.org/pipermail/arch-dev-public/2016-October/028405.html
next reply other threads:[~2022-03-21 6:35 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-21 4:31 kiasoc5--- via Development of GNU Guix and the GNU System distribution. [this message]
-- strict thread matches above, loose matches on Subject: below --
2022-03-21 13:34 Hardened toolchain zimoun
[not found] ` <Mymdzxm--3-2@tutanota.com>
2022-03-22 19:06 ` zimoun
2022-03-22 20:02 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-03-25 19:39 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-03-25 22:54 ` zimoun
2022-03-26 19:33 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-03-26 22:02 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-03-27 20:06 ` zimoun
2022-03-27 20:22 ` Maxime Devos
2022-03-28 3:17 ` Maxim Cournoyer
2022-03-28 7:35 ` zimoun
2022-03-29 0:02 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-03-29 10:15 ` Ludovic Courtès
2022-04-14 18:59 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-04-15 15:18 ` jbranso
2022-04-15 16:04 ` Zhu Zihao
2022-04-15 16:34 ` raingloom
2022-04-26 11:07 ` Katherine Cox-Buday
2022-04-28 17:36 ` Aurora
2022-04-28 17:41 ` Katherine Cox-Buday
2022-04-28 19:53 ` Aurora
2022-04-28 17:50 ` Vagrant Cascadian
2022-04-28 19:54 ` Aurora
2022-04-29 10:31 ` zimoun
2022-04-29 15:51 ` kiasoc5--- via Development of GNU Guix and the GNU System distribution.
2022-05-02 14:55 ` Katherine Cox-Buday
2022-05-02 16:25 ` Maxime Devos
2022-05-02 17:41 ` zimoun
2022-05-02 21:10 ` Maxime Devos
2022-04-15 20:36 Nathan Dehnel
2022-04-16 3:51 ` raingloom
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MyejWoQ--3-2@tutanota.com \
--to=guix-devel@gnu.org \
--cc=kiasoc5@tutanota.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).