Changeset 0ceb504

Timestamp:

08/28/2024 12:46:50 PM (2 weeks ago)

Author:

Xi Ruoyao <xry111@…>

Branches:

12.2, trunk

Children:

0c9bd83

Parents:

2ec620f

git-author:

Xi Ruoyao <xry111@…> (08/28/2024 12:43:45 PM)

git-committer:

Xi Ruoyao <xry111@…> (08/28/2024 12:46:50 PM)

Message:

building-notes: Reformat hardening options description, and fix some errors

File:

• introduction/important/building-notes.xml (modified) (1 diff)

introduction/important/building-notes.xml

@@ -1333 +1333 @@
 
       <para>
-        The main distros use much more, such as
-        <option>-Wl,-z,now</option> (disabling lazy binding to enhance
-        <option>-Wl,-z,relro</option>, so the <emphasis>entire</emphasis>
-        GOT can be made immutable), <option>-fstack-clash-protection</option>
-        (preventing the attacker from using an unchecked offset from a heap
-        address to modify the stack),
-        <option>-fcf-protection=full</option>
-        (utilizing Intel and AMD CET technology to limit the target
-        addresses of control-flow transfer instructions; to make it really
-        effective the entire system must be built with this option, Glibc
-        must be built with <option>--enable-cet</option>, and the system
-        must run on Intel Tiger Lake or newer, or AMD Zen 3 or newer),
-        and <option>-ftrivial-auto-var-init=zero</option> (initializing
-        some variables by filling zero bytes if they are otherwise
-        uninitialized).
-      </para>
+        The main distros use much more, such as:
+      </para>
+
+      <itemizedlist>
+        <listitem>
+          <para>
+            <option>-Wl,-z,now</option>: disables lazy binding to enhance
+            <option>-Wl,-z,relro</option>, so the
+            <emphasis>entire</emphasis> GOT can be made immutable.
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            <option>-fstack-clash-protection</option>: prevents the attacker
+            from using an offset large enough and not adequately checked to
+            jump over the stack guard page placed by the kernel and the
+            stack canary placed by
+            <option>-fstack-protector=strong</option>, and modify the stack
+            from a heap address, or vice versa.
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            <option>-ftrivial-auto-var-init=zero</option>: initializes
+            some variables by filling zero bytes if they are not
+            initialized by other means.
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            <option>-fcf-protection=full</option>: utilizes Intel and AMD
+            CET technology to limit the target addresses of control-flow
+            transfer instructions.  To make it really effective for a
+            package, all packages providing a shared library for the
+            package to use must be built with this option, as well as that
+            package itself, Glibc must be configured with the
+            <option>--enable-cet</option> option enabled, and the system
+            must run on Intel Tiger Lake or newer, or AMD Zen 3 or newer.
+            If the criteria is not met the program compiled with this
+            option will still run, but not really protected by CET.
+          </para>
+        </listitem>
+      </itemizedlist>
 
       <para>