fstack-protector settings

[Construx]

Linux kernel compiling options for CONFIG_CC_STACKPROTECTION appear in a section separate from the general section for grsec options, namely in the section called "processor type and features". It seems out of place here, or possibly redundant, when there is already a whole section made especially for grsecurity options. How does this feature fit in with the scheme of general grsec configuration, and is there any reason not to enable it?

[PaX Team]

this option is part of upstream linux not grsec per se, that's why it's where it is. as for its usefulness... that's a long story, but the gist of it is that SSP in the kernel as currently implemented is very much useless and i advise against using it, it only gives one a false sense of security.

[Construx]

> ".. the gist of it is that SSP in the kernel as currently implemented is very much useless and i advise against using it."

That's pretty much what I suspected, anyway. Rather like putting butter on a burn: an old wives' tale that actually did more harm than good. Thanks.