tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Default hardening options

On Wed, Aug 04, 2021 at 03:13:19PM +0000, nia wrote:
> How do we feel about turning up the default hardening options?
> I generally build with PKGSRC_USE_SSP=strong on all my boxes.
> This is harder than NetBSD base, but I've never observed any
> problems or performance impact. Importantly, it protects any
> function that has stack-based arrays from stack-based buffer
> overflows.
> I've noticed no problems caused by PKGSRC_USE_RELRO or
> PKGSRC_MKRERPO in my bulk builds. PKGSRC_USE_RELRO=partial
> would match NetBSD base.
> I believe MKPIE is still a way off, it doesn't work with e.g.
> Haskell, but that should be turned on eventually if we want
> to match NetBSD's hardening options.

I'm building my local package set (~1500) on NetBSD-current/amd64 with

PKGSRC_USE_SSP=         all

for a long time now (2016?), and had no obvious problems except having
to fix some packages that do not honor LDFLAGS (for RELRO).

Home | Main Index | Thread Index | Old Index