Mark J Cox blog/200801070918.html

mark :: blog

07 Jan 2008: Vulnerability and threat mitigation features in Red Hat Enterprise Linux and Fedora (Updated)

A year ago I published a table of Security Features in Red Hat Enterprise Linux and Fedora Core. Since then we've released two more Fedora versions, and a Red Hat Enterprise Linux, so it's time to update the table.

Between releases there are lots of changes made to improve security and I've not listed everything; just a high-level overview of the things I think are most interesting that help mitigate security risk. We could go into much more detail, breaking out the number of daemons covered by the SELinux default policy, the number of binaries compiled PIE, and so on.

Fedora Core Fedora Red Hat Enterprise Linux

1 2 3 4 5 6 7 8 3 4 5

2003Nov 2004May 2004Nov 2005Jun 2006Mar 2006Oct 2007May 2007Nov 2003Oct 2005Feb 2007Mar

Firewall by default Y Y Y Y Y Y Y Y Y Y Y

Signed updates required by default Y Y Y Y Y Y Y Y Y Y Y

NX emulation using segment limits by default Y Y Y Y Y Y Y Y Y² Y Y

Support for Position Independent Executables (PIE) Y Y Y Y Y Y Y Y Y² Y Y

Address Randomization (ASLR) for Stack/mmap by default³ Y Y Y Y Y Y Y Y Y² Y Y

ASLR for vDSO (if vDSO enabled)³ no vDSO Y Y Y Y Y Y Y no vDSO Y Y

Restricted access to kernel memory by default Y Y Y Y Y Y Y Y Y

NX for supported processors/kernels by default Y¹ Y Y Y Y Y Y Y² Y Y

Support for SELinux Y Y Y Y Y Y Y Y Y

SELinux enabled with targeted policy by default Y Y Y Y Y Y Y Y

glibc heap/memory checks by default Y Y Y Y Y Y Y Y

Support for FORTIFY_SOURCE, used on selected packages Y Y Y Y Y Y Y Y

All packages compiled using FORTIFY_SOURCE Y Y Y Y Y Y

Support for ELF Data Hardening Y Y Y Y Y Y Y

All packages compiled with stack smashing protection Y Y Y Y Y

SELinux Executable Memory Protection Y Y Y Y

glibc pointer encryption by default Y Y Y Y

FORTIFY_SOURCE extensions including C++ coverage Y

¹ Since June 2004, ² Since September 2004, ³ Selected Architectures

Created: 07 Jan 2008
Tagged as: fedora, red hat, security

0 comments (new comments disabled)

Hi! I'm Mark Cox. This blog gives my thoughts and opinions on my security work, open source, fedora, home automation, and other topics.

pics from my twitter: