Re: adding support for hardened toolchain

[Bryan Hundven <bryanhundven at gmail dot com>]

Heiko, All,

On Wed, Jan 5, 2011 at 11:50 AM, Heiko Zuerker <heiko@zuerker.org> wrote:
> Quoting Bryan Hundven <bryanhundven@gmail.com>:
>
> [.............]
>
>>> The hardened toolchain is not anything folks would look at on their own
>>> usually. Adding it to ct-ng would give it more exposure and more folks
>>> may
>>> tend to try it out. We really need to get to a place where things get
>>> more
>>> secure for everybody.
>>>
>>> We'll see when I actually get a chance to look into writing a patch for
>>> this...
>>
>> After looking into this a bit more, I think I get it now, and I would
>> like to see this get into crosstool-ng.
>
> Cool :)
>
>> It seems to me that the patch directory needs to be refactored. I
>> would suggest something like:
>>
>> patches/
>> Â<architecture>/
>> Â Â Â<program>/
>> Â Â Â Â Â<version>/
>> Â Â Â Â Â Â <patch>.patch
>>
>> Where one of the "architecture"s would be "any" and another would be
>> "security", besides just x86, powerpc, arm, etc...
>>
>> This makes sense, because my x86 toolchain doesn't need patches that
>> are specific to powerpc, and if the CT_TOOLCHAIN_HARDENING is enabled,
>> it will apply patches from "security". Patches that would be applied
>> regardless of architecture would go in "any".
>
> On one hand I really like the idea of separating the architectures out, but
> on the other hand I'm a bit worried about inter-dependencies. Of course this
> could also simply be solved by moving these specific patches into "any". We
> need to be careful not to turn this whole thing into a maintenance nightmare
> whenever a new i.e. gcc comes out.

It pretty much already is. This is one reason why everyone is so
touchy about patches, and why no one has ported any patches forward to
gcc-4.5.x.

Basically, we need to verify/validate each patch with gcc developers
to make sure the patch is doing what we expect them to.

By all means, I'm not saying that my suggestion is how it should be,
but maybe if I stir up the bees nest by putting the idea out there, we
can make progress on the "correct" path.

> --
>
> Regards
> ÂHeiko Zuerker
> Âhttp://www.devil-linux.org
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
>
>
> --
> For unsubscribe information see http://sourceware.org/lists.html#faq
>
>

-Bryan

--
For unsubscribe information see http://sourceware.org/lists.html#faq