action #64084
closed[sle][security][sle15sp2] Implement test for "Switch from CC_STACKPROTECTOR to CC_STACKPROTECTOR_STRONG"
0%
Description
We (security team) would like to see a switch from CC_STACKPROTECTOR to CC_STACKPROTECTOR_STRONG in the kernel. This provides better protection against stack based buffer overflows. We hope that it's an easy switch since we have CC_STACKPROTECTOR for quite a while and CC_STACKPROTECTOR_STRONG only add some additional criteria when to add the code to check the canary.
To be mentioned here, the feature should be applied to all platforms (x86_64/aarch64/ppc64) but not ready in s390x platform yet.
Updated by rfan1 about 4 years ago
rfan1 wrote:
We (security team) would like to see a switch from CC_STACKPROTECTOR to CC_STACKPROTECTOR_STRONG in the kernel. This provides better protection against stack based buffer overflows. We hope that it's an easy switch since we have CC_STACKPROTECTOR for quite a while and CC_STACKPROTECTOR_STRONG only add some additional criteria when to add the code to check the canary.
To be mentioned here, the feature should be applied to all platforms (x86_64/aarch64/ppc64) but not ready in s390x platform yet.