Re: how to turn off PIE on Fedora?

[Brad Roberts <braddr at puremagic dot com>]

This is largely offtopic for this list, but wouldn't having it user
disableable largely defeat the safety that exec-shield is attempting to
provide?

Later,
Brad

On Fri, 12 Dec 2003, Per Bothner wrote:

> Date: Fri, 12 Dec 2003 19:32:35 -0800
> From: Per Bothner <per@bothner.com>
> To: Daniel Berlin <dberlin@dberlin.org>
> Cc: gcc@gcc.gnu.org, dnovillo@redhat.com
> Subject: Re: how to turn off PIE on Fedora?
>
> Daniel Berlin wrote:
>
> > [root@dberlin bin]# grep exec-shield /etc/sysctl.conf
> > kernel.exec-shield = 0
> > kernel.exec-shield-randomize = 0
>
> Thanks for the quick response from you and Diego.  But
> I hope that isn't the official Red Hat answer.
> If Red Hat thinks PIE is useful then suggesting that
> people turn it off globally isn't an acceptable solution.
> If Red Hat doesn't think it is useful, then it shouldn't
> be enabled by default.
>
> There are many machines (including mine) where people
> might want to run gdb which have either untrusted users
> or run network servers.
>
> I can accept "exec shield is a work-in-progress and for
> now it has to be enabled/disabled globally."  But I hope
> no-one will consider it "done" if that is the case.
>
> The natural solution would be an environment variable
> that would turn off exec-shielf.  Gdb should set that for
> inferior processes by default.  I don't know if that is
> possible, or if that might add vulnerability.  (Changing
> users should probably re-enable exec-shield.)
>
> There is still the question of PCH support - though I'm hoping
> the compile-server will be a good alternative.
> --
> 	--Per Bothner
> per@bothner.com   http://per.bothner.com/
>
>