diff -Naur uClibc-20060529.orig/extra/Configs/Config.in uClibc-20060529/extra/Configs/Config.in --- uClibc-20060529.orig/extra/Configs/Config.in 2006-05-29 07:10:22.000000000 +0000 +++ uClibc-20060529/extra/Configs/Config.in 2006-05-29 09:48:35.000000000 +0000 @@ -1302,27 +1302,36 @@ Most people will answer N. +config MKTEMP_USES_ARC4RANDOM + bool "Use arc4randon() in mktemp(3)" + depends on UCLIBC_HAS_ARC4RANDOM + default n + help + Answer Y to use arc4random() in mktemp(3). + + Most people will answer N. + config HAVE_NO_SSP bool default n config UCLIBC_HAS_SSP - bool "Support for propolice smashing stack protector" + bool "Support for stack smashing protector" depends on !HAVE_NO_SSP default n help - Add propolice smashing stack protector to the library. + Add stack smashing protector (aka: propolice) to the library. This requires GCC 4.1, supporting the -fstack-protector[-all] options. GCC does not have to provide libssp, the needed functions are added to ldso/libc instead. Most people will answer N. config UCLIBC_HAS_SSP_COMPAT - bool "Support for gcc-3.x propolice smashing stack protector" + bool "Support for gcc-3.x stack smashing protector" depends on UCLIBC_HAS_SSP default n help - Add gcc-3.x propolice smashing stack protector to the library. + Add gcc-3.x propolice stack smashing protector to the library. This requires a patched version of GCC, supporting the -fstack-protector[-all] options, with the __guard and __stack_smash_handler functions removed from libgcc. @@ -1332,21 +1341,21 @@ Most people will answer N. config SSP_QUICK_CANARY - bool "Use simple guard values without accessing /dev/urandom" + bool "Use simple canary values without accessing /dev/urandom" depends on UCLIBC_HAS_SSP default n help Use gettimeofday(2) to define the __guard without accessing /dev/urandom. - WARNING: This makes smashing stack protector vulnerable to timing + WARNING: This makes stack smashing protector vulnerable to timing attacks. Most people will answer N. choice - prompt "Propolice protection blocking signal" + prompt "Stack smashing protector blocking signal" depends on UCLIBC_HAS_SSP - default PROPOLICE_BLOCK_ABRT if ! DODEBUG - default PROPOLICE_BLOCK_SEGV if DODEBUG + default SSP_BLOCK_ABRT if ! DODEBUG + default SSP_BLOCK_SEGV if DODEBUG help "abort" use SIGABRT to block offending programs. This is the default implementation. @@ -1356,20 +1365,21 @@ If unsure, answer "abort". -config PROPOLICE_BLOCK_ABRT +config SSP_BLOCK_ABRT bool "abort" -config PROPOLICE_BLOCK_SEGV +config SSP_BLOCK_SEGV bool "segfault" endchoice config UCLIBC_BUILD_SSP - bool "Build uClibc with propolice protection" + bool "Build uClibc with stack smashing protection" depends on UCLIBC_HAS_SSP default n help - Build all libraries and executables with propolice protection enabled. + Build all libraries and executables with stack smashing protection + enabled. config UCLIBC_BUILD_RELRO bool "Build uClibc with RELRO" diff -Naur uClibc-20060529.orig/libc/misc/internals/tempname.c uClibc-20060529/libc/misc/internals/tempname.c --- uClibc-20060529.orig/libc/misc/internals/tempname.c 2006-05-29 07:11:24.000000000 +0000 +++ uClibc-20060529/libc/misc/internals/tempname.c 2006-05-29 09:39:07.000000000 +0000 @@ -136,6 +136,7 @@ "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; #define NUM_LETTERS (62) +#if !defined(__MKTEMP_USES_ARC4RANDOM__) static unsigned int fillrand(unsigned char *buf, unsigned int len) { int fd; @@ -174,6 +175,7 @@ buf[i] = letters[k]; } } +#endif /* __MKTEMP_USES_ARC4RANDOM__ */ /* Generate a temporary file name based on TMPL. TMPL must match the rules for mk[s]temp (i.e. end in "XXXXXX"). The name constructed @@ -207,10 +209,16 @@ } /* Get some random data. */ +#if defined(__MKTEMP_USES_ARC4RANDOM__) + for (i = 0 ; i < sizeof(randomness) ; i++) { + randomness[i] = (arc4random() % 62); + } +#else if (fillrand(randomness, sizeof(randomness)) != sizeof(randomness)) { /* if random device nodes failed us, lets use the braindamaged ver */ brain_damaged_fillrand(randomness, sizeof(randomness)); } +#endif /* __MKTEMP_USES_ARC4RANDOM__ */ for (i = 0; i < sizeof(randomness); ++i) XXXXXX[i] = letters[(randomness[i]) % NUM_LETTERS]; diff -Naur uClibc-20060529.orig/libc/sysdeps/linux/common/ssp.c uClibc-20060529/libc/sysdeps/linux/common/ssp.c --- uClibc-20060529.orig/libc/sysdeps/linux/common/ssp.c 2006-05-29 07:11:06.000000000 +0000 +++ uClibc-20060529/libc/sysdeps/linux/common/ssp.c 2006-05-29 09:46:49.000000000 +0000 @@ -20,7 +20,7 @@ #error "file must not be compiled with stack protection enabled on it. Use -fno-stack-protector" #endif -#ifdef __PROPOLICE_BLOCK_SEGV__ +#ifdef __SSP_BLOCK_SEGV__ # define SSP_SIGTYPE SIGSEGV #else # define SSP_SIGTYPE SIGABRT