Re: When did Debian decide to enable PIE by default?

From	<tomas@tuxteam.de>
Newsgroups	linux.debian.user
Subject	Re: When did Debian decide to enable PIE by default?
Date	2017-08-10 10:00 +0200
Message-ID	<ucQxP-2tn-1@gated-at.bofh.it> (permalink)
References	<ucAjo-bt-11@gated-at.bofh.it> <ucAjo-bt-9@gated-at.bofh.it> <ucCle-1qq-27@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Aug 09, 2017 at 02:49:06PM +0000, 慕 冬亮 wrote:
> 
> 
> On 08/09/2017 10:31 AM, Thomas Schmitt wrote:
> > Hi,
> >
> > 慕 冬亮 <mudongliangabcd@hotmail.com> wrote:
> >> When does Debian Team, or Security Team decide to enable PIE by default?
> > I guess it was one year ago. At least that's the dates one can see on
> >    https://wiki.debian.org/Hardening/PIEByDefaultTransition
> Such a good news for me, a student learning information security. 
> However, I have a doubt, why does Debian enable PIE by default, other 
> than stack protector and FORTIFY_SOURCE that are already enabled by 
> default in the Ubuntu distribution?
> 
> I think stack protector(FORTIFY_SOURCE) has less overhead than PIE.

As far as I understand, stack protection and/or FORTIFY_SOURCE are
about protecting from buffer overflows. Stack protection sounds
pretty generic, in the case of FORTIFY_SOURCE, it's the compiler
doing extra compile-time checks (when possible) and inserting extra
run-time check code.

PIE isn't a security measure in itself -- it just allows such code
to be dynamically mapped at any address. But it enables address space
layout randomisation [1], which isn't a security measure in itself
either, but a *mitigation* technique: if an attacker has already
managed to take control of your program counter (e.g. by rewriting
a return address... possibly via a stack overflow, see above), you
make his/her life harder by not putting (potentially useful) code
at a place (s)he knows how to find.

It's like putting a chair in a dark room. Of course you should
try to make your door and lock as secure as possible. But just
in case...

>       No System Is Safe!

exactly :-)

Cheers
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlmMERMACgkQBcgs9XrR2kantACfXjHdLt0pWUu3sV6sui/8SB4F
J7UAnR0WzXmHw2WETK9UddYeHTjmc1u/
=MhEm
-----END PGP SIGNATURE-----

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: When did Debian decide to enable PIE by default? "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-09 16:40 +0200
  Re: When did Debian decide to enable PIE by default? Gene Heskett <gheskett@shentel.net> - 2017-08-09 16:50 +0200
    Re: When did Debian decide to enable PIE by default? Dan Ritter <dsr@randomstring.org> - 2017-08-09 17:10 +0200
      Re: When did Debian decide to enable PIE by default? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-08-09 20:00 +0200
    Re: When did Debian decide to enable PIE by default? Tony van der Hoff <lists@vanderhoff.org> - 2017-08-09 17:30 +0200
    Re: When did Debian decide to enable PIE by default? Gene Heskett <gheskett@shentel.net> - 2017-08-10 02:30 +0200
      Re: When did Debian decide to enable PIE by default? <tomas@tuxteam.de> - 2017-08-10 10:10 +0200
        Re: When did Debian decide to enable PIE by default? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-08-12 13:20 +0200
          Re: When did Debian decide to enable PIE by default? <tomas@tuxteam.de> - 2017-08-12 16:10 +0200
  Re: When did Debian decide to enable PIE by default? <tomas@tuxteam.de> - 2017-08-10 10:00 +0200

csiph-web