Sunday, May 13, 2012  Automatic binary hardening with Autoconf
How do you protect a C program against memory corruption
exploits? We should try to write code with no bugs, but we also
need protection against any bugs which may lurk. Put another
way, I try not to crash my bike but I still wear a helmet.
Operating systems now support a variety of tricks to make life
difficult for would-be attackers. But most of these hardening
features need to be enabled at compile time. When I started
contributing to Mosh, I made it a goal to build with full
hardening on every platform, not just proactive distributions
like Ubuntu. This means detecting available hardening features
at compile time.  Mosh uses Autotools, so this code is naturally
part of the Autoconf script. I know that Autotools has a bad
reputation in some circles, and I'm not going to defend it here.
But a huge number of existing projects use Autotools. They can
benefit today from a drop-in hardening recipe.  I've published
an example project which uses Aut