Another common reason for rebuilding all packages is to automatically
add some protection from "stack smashing" attacks, e.g., with the
Stack Guard
modification to the gcc
compiler. As the link suggests, one
Linux distribution,
Immunix,
contains packages recompiled with this protection.
This process is similar to that discussed above, but the packages
should be compiled with a stackguard protected compiler. Most
packages should have CFLAGS='-fstack-protector'
added.
It is important to note that not every program can be protected - this breaks some applications for an unknown reason.
gcc
One package requires extensive changes: gcc
must have stackguard
added to it. A description of the process is available at
http://www.trl.ibm.com/projects/security/ssp/.