Next Previous Contents

8. Stack Guard

Another common reason for rebuilding all packages is to automatically add some protection from "stack smashing" attacks, e.g., with the Stack Guard modification to the gcc compiler. As the link suggests, one Linux distribution, Immunix, contains packages recompiled with this protection.

This process is similar to that discussed above, but the packages should be compiled with a stackguard protected compiler. Most packages should have CFLAGS='-fstack-protector' added.

It is important to note that not every program can be protected - this breaks some applications for an unknown reason.

8.1 Modifying gcc

One package requires extensive changes: gcc must have stackguard added to it. A description of the process is available at http://www.trl.ibm.com/projects/security/ssp/.


Next Previous Contents