is stack-smashing protection on on Debian?

Question

I heard that every binary that comes with Ubuntu is protected with stack-smashing protection and possibly other gcc features to harden programs against common security threats. What about Debian? I couldn't find any definitive info on the Internet.

Answer 1

This is in process. Going to http://wiki.debian.org/Hardening leads to http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags, which leads to Raphael Hertzog's message to debian-devel-announce, on behalf of the dpkg developers. See the para beginning

* dpkg-buildflags now returns hardening build flags by default

So, this feature may be in the next release.

Answer 2

The following is a list of exploit protection mechanisms that have been added to most of the major versions of Linux, Debian being the notable exception:

Stack Protector (gcc’s -fstack-protector)
Heap Protector (GNU C Library heap protector)
Pointer Obfuscation (Some pointers stored in glibc are obfuscated)
Address Space Layout Randomisation (ASLR)
Several daemons built as Position Independent Executables (PIE)
Some daemons (?) built with Fortify Source “-D_FORTIFY_SOURCE=2″

Most, if not all, of these features are not enabled by default in Debian. They are however enabled by default in Ubuntu. As pointed out above http://wiki.debian.org/Hardening has a wealth of information regarding how to harden a Debian system, and for some insight as to the status of built in protection mechanisms in the upcoming release see: http://lists.debian.org/debian-devel-announce/2011/01/msg00006.html A direct answer to your question is inconclusive. The Debian security team has not indicated one way or another what their plans are. So maybe they will be included in the Wheezy release, but they are definitely not included in Squeeze.