[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Default hardening options
How do we feel about turning up the default hardening options?
I generally build with PKGSRC_USE_SSP=strong on all my boxes.
This is harder than NetBSD base, but I've never observed any
problems or performance impact. Importantly, it protects any
function that has stack-based arrays from stack-based buffer
I've noticed no problems caused by PKGSRC_USE_RELRO or
PKGSRC_MKRERPO in my bulk builds. PKGSRC_USE_RELRO=partial
would match NetBSD base.
I believe MKPIE is still a way off, it doesn't work with e.g.
Haskell, but that should be turned on eventually if we want
to match NetBSD's hardening options.
Main Index |
Thread Index |