Autore: Neil Youngman Data: To: exim-users Oggetto: [exim] Stack protection
Given that we can't guarantee that Exim contains no further bugs enabling stack overflows, I wondered if it would be wise to add stack protection to the default build?
In Linux this would appear to be a simple case of adding -fstack-protector-all (or -fstack-protector) to CFLAGS in OS/Makefile-Linux
The obvious drawback is that older systems do not support this (I believe it requires at least gcc 4.1). It may also have performance implications or other subtler drawbacks of which I am not aware.
Is there any experience on the list of this?
Is it a good idea?
Are there other similar measures we could take to increase the resilience of the default build to potential exploits?