Error: I'm afraid this is the first I've heard of a "html," flavoured Blosxom. Try dropping the "/+html," bit from the end of the URL.
Vulnerability and threat mitigation features in Red Hat Enterprise Linux and Fedora (Updated)
A year ago I published a table of
Security Features in
Red Hat Enterprise Linux and Fedora Core. Since then we've released
two more Fedora versions, and a Red Hat Enterprise Linux, so it's time to
update the table.
Between releases there are lots of changes made to improve security and I've not listed everything; just a high-level overview of the things I think are most interesting that help mitigate security risk. We could go into much more detail, breaking out the number of daemons covered by the SELinux default policy, the number of binaries compiled PIE, and so on.
| Fedora Core | Fedora | Red Hat Enterprise Linux | |||||||||
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 3 | 4 | 5 | |
| 2003Nov | 2004May | 2004Nov | 2005Jun | 2006Mar | 2006Oct | 2007May | 2007Nov | 2003Oct | 2005Feb | 2007Mar | |
| Firewall by default | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
| Signed updates required by default | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
| NX emulation using segment limits by default | Y | Y | Y | Y | Y | Y | Y | Y | Y2 | Y | Y |
| Support for Position Independent Executables (PIE) | Y | Y | Y | Y | Y | Y | Y | Y | Y2 | Y | Y |
| Address Randomization (ASLR) for Stack/mmap by default3 | Y | Y | Y | Y | Y | Y | Y | Y | Y2 | Y | Y |
| ASLR for vDSO (if vDSO enabled)3 | no vDSO | Y | Y | Y | Y | Y | Y | Y | no vDSO | Y | Y |
| Restricted access to kernel memory by default | Y | Y | Y | Y | Y | Y | Y | Y | Y | ||
| NX for supported processors/kernels by default | Y1 | Y | Y | Y | Y | Y | Y | Y2 | Y | Y | |
| Support for SELinux | Y | Y | Y | Y | Y | Y | Y | Y | Y | ||
| SELinux enabled with targeted policy by default | Y | Y | Y | Y | Y | Y | Y | Y | |||
| glibc heap/memory checks by default | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Support for FORTIFY_SOURCE, used on selected packages | Y | Y | Y | Y | Y | Y | Y | Y | |||
| All packages compiled using FORTIFY_SOURCE | Y | Y | Y | Y | Y | Y | |||||
| Support for ELF Data Hardening | Y | Y | Y | Y | Y | Y | Y | ||||
| All packages compiled with stack smashing protection | Y | Y | Y | Y | Y | ||||||
| SELinux Executable Memory Protection | Y | Y | Y | Y | |||||||
| glibc pointer encryption by default | Y | Y | Y | Y | |||||||
| FORTIFY_SOURCE extensions including C++ coverage | Y | ||||||||||