Re: Solaris security extensions

[Greg Troxel <gdt%lexort.com@localhost>]

"Clausen, Jörn" <joern.clausen%uni-bielefeld.de@localhost> writes:

> I think Oracle's security extensions make sense and are not something
> to use "instead" of other methods, but "in addition". To broaden my
> question: I would expect other OSes to come up with similar
> methods. Should pkgsrc consider a mechanism to add such features
> (i.e. as default in mk/platform/*.mk), that can be switched off
> globally or per packet, if desired. And if the answer to this question
> is "yes", what has to be done to the toolchain to support this? Perl's
> handling of linker flags is probably one problem. I also tried
> compiling security/openssl, and it failed in a different way. Maybe
> the few packages that did compile so far all used libtool, and all
> others tend to have problems, I'm not sure.

I think this does make sense to support, but would guess it's a lot of
work.

NetBSD has various pax things (SSP, mprotect) and these seem similar.
You might see how those are handled in pkgsrc, and how the semantics of
the Solaris features match or don't match.  In particular it seems clear
from the NetBSD experience that there needs to be a per-package variable
or other accomodations to disable the feature for packages that don't
work with it.  This can be omitting the compiler flags, or it can be
marking a binary once built.

I suspect  many of the same programs will have the same issues.  So it
may be that the same variables, if the semantics match, can turn on
corresponding Solaris flags.

Look in mk for:
  PKGSRC_USE_FORTIFY
  PKGSRC_USE_RELRO
  PKGSRC_USE_SSP
  NOT_PAX_MPROTECT_SAFE