Bug 108165
| Summary: | Make sshd a PIE | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ulrich Drepper <drepper> | ||||||
| Component: | openssh | Assignee: | Tomas Mraz <tmraz> | ||||||
| Status: | CLOSED RAWHIDE | QA Contact: | Brian Brock <bbrock> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | rawhide | CC: | jakub, mitr, pdemauro, tao | ||||||
| Target Milestone: | --- | Keywords: | FutureFeature | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Enhancement | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2005-02-21 16:02:23 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 107774 | ||||||||
| Attachments: |
|
||||||||
Created attachment 95543 [details]
Minimal patch
Created attachment 95567 [details]
Better patch
Better use Jakub's patch which also adds various optimizations.
The minimal patch is maintainable and could/(should?) be applied. The Jakub's one is highly invasive and it would require too much work when rebasing to newer versions. Sorry ignore my previous comment - currently in rawhide the complete OpenSSH is already built with PIE. However a question is if the PIE linkage shouldn't be limited to sshd. |
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6a) Gecko/20031021 Firebird/0.7+ Description of problem: Network accessible programs should be PIEs for security reasons. I'll attach a minimum patch to make sshd (and none of the other programs) a PIE. Version-Release number of selected component (if applicable): openssh-3.6.1p2-19 How reproducible: Always Steps to Reproduce: 1.readelf -h /usr/sbin/sshd|fgrep Type: 2. 3. Actual Results: Type: EXEC (Executable file) Expected Results: Type: DYN (Shared object file) Additional info: