On 01/19/2015 03:27 PM, Michael Cook wrote: > On 01/19/2015 06:09 PM, walt wrote: >> gcc-4.9.2 surprised me by landing on ~amd64 today, and I'm still >> very vague about the status of stack protection on gentoo. >> >> I seem to recall reading (somewhere) that gcc-4.9.x is needed for >> compiling the kernel with CONFIG_CC_STACK_PROTECTOR_STRONG so I've >> never tried it until today. >> >> Is my recollection accurate? Does gcc-4.9.x include more/different >> support than gcc-4.8.x for stack protection? >> >> Anyway, so far, so good. I recompiled and rebooted kernel 3.14.29 >> with strong stack protection enabled and all seems good. (Uptime is >> 20 minutes and counting ;) >> >> >> > Yep, they added another stack protector option. Basically it offers > better security than compiling with -fstack-protector and less > overkill than compiling with -fstack-protector-all. > > Read more http://lwn.net/Articles/584225/ (it is GCC 4.9+)
Excellent article, thanks for the link. Maybe you can un-confuse me about the "libssp" useflag? Some googling has made me think that the gcc package *can* install libssp, but my gcc-4.9.2 is built with the --disable-libssp flag, which (maybe?) prevents the installation of libssp? (I definitely don't have libssp.) Who might want to use libssp, and why might I want to avoid it? Thanks for any clues.
