3 ms·
Which Linux distributions are planning to use this new fortification level, and in what circumstances? I can imagine enabling this in programs that directly in
by dwheeler 4y ago
Which Linux distributions are planning to use this new fortification level, and in what circumstances?
I can imagine enabling this in programs that directly interact with the internet, e.g., web browsers, email clients, and resolver libraries. I can imagine Debian, Ubuntu, and Red Hat enabling it. It would especially make sense for Tails, at least in some cases. But that doesn't mean it will happen. I'd love to hear more.
- siddhesh 4y agoOpenSUSE already enables it across the distribution; they were the first to do it. I believe Gentoo either already has or is in the process of doing it. I'll make a proposal for Fedora once I have a better idea of the code size and performance impact.
- thulle 4y ago> I believe Gentoo either already has or is in the process of doing it. There's a bug with the patch to enable it, tracking issues in other packages, so they seem to be in the process.
- pjmlp 4y agoAndroid usually takes advantages of this kind of fortifiation levels (however the clang equivalents), SELinux is also enabled by default, syscalls are whitelisted on seccomp, hardware memory tagging is now done when available, and for poor folks like Termux, using anything not declared as public NDK API might kill the process.