{"id":379,"date":"2010-09-07T11:06:42","date_gmt":"2010-09-07T19:06:42","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=379"},"modified":"2010-09-07T12:45:28","modified_gmt":"2010-09-07T20:45:28","slug":"cross-distro-default-security-protection-review","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2010\/09\/07\/cross-distro-default-security-protection-review\/","title":{"rendered":"cross-distro default security protection review"},"content":{"rendered":"

The recent work<\/a> by MWR Labs does a reasonable job showing Debian’s poor pro-active security and why I am so frustrated<\/a> about it: we have not been able to move very quickly at getting it enabled. While my hardening-includes<\/a> package is available to maintainers that want to turn on protections for their builds, it’s still a far cry from having it be distro-wide, and it doesn’t protect people that build stuff by hand. We were able to solve this in Ubuntu very directly a while ago by improving the compiler itself.<\/p>\n

Since SSP and FORTIFY_SOURCE can only be confirmed (it’s not possible without source analysis to see if it should<\/em> have been enabled), it would be nice to see what binaries differed between distros on this. Most of the “SSP disabled” stuff are binaries that lack character arrays on the stack to begin with, and the FORTIFY_SOURCE stuff may have done all compile-time protections. The comments about “other distributions could potentially enable it for a few more binaries” is a bit misleading since, for all but Debian, both SSP and FORTIFY_SOURCE are<\/em> enabled for all builds.<\/p>\n

I did appreciate the nod to Ubuntu for being the only distro without by-default PIE that built Firefox with PIE. Given that Firefox is the #2 most vulnerable piece of software in a desktop distro, it was important to do it. (The #1 most vulnerable is the kernel itself — I’m counting number of fixed CVEs for this stat.)<\/p>\n

The kernel analysis by MWR seems rather incomplete. Also, it’s not clear to me which distros were running a PAE kernel, which would change some of the results. I didn’t see any mention of several other userspace protections that the kernel can provide, for example:<\/p>\n