From Fedora Project Wiki
(new change proposal)
 
(→‎Scope: remove template strings)
Line 50: Line 50:
 
Change the rpm macros to build packages by default with PIC/PIE flags (i.e. set _hardened_package to 1 by default).
 
Change the rpm macros to build packages by default with PIC/PIE flags (i.e. set _hardened_package to 1 by default).
  
* Release engineering: N/A (not a System Wide Change)  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+
* Release engineering:
 
Do a mass rebuild for all arch packages
 
Do a mass rebuild for all arch packages
  
* Policies and guidelines: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+
* Policies and guidelines:
 
Adjust the Packaging Guidelines to allow non-PIC packages only if the package is not working otherwise and require a tracker bug similiar to packages not working on certain archs. Update the Guidlines to reflect the new defaults.
 
Adjust the Packaging Guidelines to allow non-PIC packages only if the package is not working otherwise and require a tracker bug similiar to packages not working on certain archs. Update the Guidlines to reflect the new defaults.
  

Revision as of 08:19, 14 December 2014

Change Proposal Name

Harden all packages with position-independent code

Summary

Harden all packages with position-independent code to limit the damage from certain security vulnerabilities.

Owner

  • Name: Till Maas
  • Email: opensource@till.name
  • Release notes owner:

Current status

  • Targeted release: Fedora 22
  • Last updated: 2014-12-13
  • Tracker bug: <will be assigned by the Wrangler>

Detailed Description

Currently, the Packaging Guidelines allow maintainers to decide whether their packages use position-independent code (PIC). There are rules that say that a lot of packages should use PIC, but in reality a lot of packages do not use PIC even if they must. Also since a lot of packags if not all potentially process untrusted input, it makes sense for these packages to use PIC to enhance the security of Fedora. Therefore I propose to build all packages with PIC by changing RPM to use the appropriate flags by default.

References:

Benefit to Fedora

Packages in Fedora will be more secure than in other distributions or packages provided by upstream. Therefore our users less likely become victims of attacks. Fedora will use more state-of-the-art security mechanisms to fulfill its first and features foundations.

Scope

  • Proposal owners:

Help writing the new packaging guidelines.

  • Other developers:

Change the rpm macros to build packages by default with PIC/PIE flags (i.e. set _hardened_package to 1 by default).

  • Release engineering:

Do a mass rebuild for all arch packages

  • Policies and guidelines:

Adjust the Packaging Guidelines to allow non-PIC packages only if the package is not working otherwise and require a tracker bug similiar to packages not working on certain archs. Update the Guidlines to reflect the new defaults.

Upgrade/compatibility impact

This should not cause problems with upgrades.

How To Test

  1. Running checksec should always report only

Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH otherwise a tracking bug should exist for the respective packages. All packages need to be tested as usual for normal behaviour.

User Experience

Fedora users might notice less sucessful attacks on their systems.

Dependencies

The rpm macros for Fedora need to be adjusted. Prelink might be retired.

Contingency Plan

  • Contingency mechanism: Rebuild packages that do not work because of this without PIC. If there are too many packaged, do a mass rebuild again without PIC for all arch packages.
  • Contingency deadline: If no mass rebuild is needed, indidual packages can be rebuilt at any time.
  • Blocks release? No

Documentation

The current packaging guidelines can be consulted.


Release Notes

Fedora now hardens as much packages as possible with position-independent code to reduce the impact of certain potential security vulnerabilities.