Hacker News Reader

Which Linux distributions are planning to use this new fortification level, and in what circumstances?

I can imagine enabling this in programs that directly interact with the internet, e.g., web browsers, email clients, and resolver libraries. I can imagine Debian, Ubuntu, and Red Hat enabling it. It would especially make sense for Tails, at least in some cases. But that doesn't mean it will happen. I'd love to hear more.

View on HN

OpenSUSE already enables it across the distribution; they were the first to do it. I believe Gentoo either already has or is in the process of doing it. I'll make a proposal for Fedora once I have a better idea of the code size and performance impact.

> I believe Gentoo either already has or is in the process of doing it.

There's a bug with the patch to enable it, tracking issues in other packages, so they seem to be in the process.

Android usually takes advantages of this kind of fortifiation levels (however the clang equivalents), SELinux is also enabled by default, syscalls are whitelisted on seccomp, hardware memory tagging is now done when available, and for poor folks like Termux, using anything not declared as public NDK API might kill the process.

Reply on news.ycombinator.com