tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Default hardening options

How do we feel about turning up the default hardening options?

I generally build with PKGSRC_USE_SSP=strong on all my boxes.
This is harder than NetBSD base, but I've never observed any
problems or performance impact. Importantly, it protects any
function that has stack-based arrays from stack-based buffer

I've noticed no problems caused by PKGSRC_USE_RELRO or
PKGSRC_MKRERPO in my bulk builds. PKGSRC_USE_RELRO=partial
would match NetBSD base.

I believe MKPIE is still a way off, it doesn't work with e.g.
Haskell, but that should be turned on eventually if we want
to match NetBSD's hardening options.

Home | Main Index | Thread Index | Old Index