Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I heard that every binary that comes with Ubuntu is protected with stack-smashing protection and possibly other gcc features to harden programs against common security threats. What about Debian? I couldn't find any definitive info on the Internet.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

This is in process. Going to http://wiki.debian.org/Hardening leads to http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags, which leads to Raphael Hertzog's message to debian-devel-announce, on behalf of the dpkg developers. See the para beginning

* dpkg-buildflags now returns hardening build flags by default

So, this feature may be in the next release.

share|improve this answer
add comment

The following is a list of exploit protection mechanisms that have been added to most of the major versions of Linux, Debian being the notable exception:

Stack Protector (gcc’s -fstack-protector)
Heap Protector (GNU C Library heap protector)
Pointer Obfuscation (Some pointers stored in glibc are obfuscated)
Address Space Layout Randomisation (ASLR)
Several daemons built as Position Independent Executables (PIE)
Some daemons (?) built with Fortify Source “-D_FORTIFY_SOURCE=2″

Most, if not all, of these features are not enabled by default in Debian. They are however enabled by default in Ubuntu. As pointed out above http://wiki.debian.org/Hardening has a wealth of information regarding how to harden a Debian system, and for some insight as to the status of built in protection mechanisms in the upcoming release see: http://lists.debian.org/debian-devel-announce/2011/01/msg00006.html A direct answer to your question is inconclusive. The Debian security team has not indicated one way or another what their plans are. So maybe they will be included in the Wheezy release, but they are definitely not included in Squeeze.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.