725941 - Allow to enable a set of hardening flags

Status: RESOLVED INVALID

(NSPR :: NSPR, defect)

Description

[Mike Hommey [:glandium]]

See http://wiki.debian.org/Hardening

Comment 1

[Mike Hommey [:glandium]]

Attachment: Allow to enable a set of hardening flags

Comment 2

[AnAkkk]

Is there any progress on this?
Many distributions have hardening flags enabled by default for all packages or just for firefox, e.g. https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/firefox&id=16277db3aa6776d34ce691bd2cc87b76dbfc6336#n94

This is the arch firefox:
$ hardening-check /usr/bin/firefox
/usr/bin/firefox:
 Position Independent Executable: yes
 Stack protected: yes
 Fortify Source functions: yes (some protected functions found)
 Read-only relocations: yes
 Immediate binding: yes

This is firefox-nightly from Mozilla:
$ hardening-check /usr/bin/firefox-nightly 
/usr/bin/firefox-nightly:
 Position Independent Executable: no, normal executable!
 Stack protected: no, not found!
 Fortify Source functions: no, only unprotected functions found!
 Read-only relocations: no, not found!
 Immediate binding: no, not found!