the state of ASLR, PIE, SSP on Debian in 2018?

Question

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).

Did the situation improve with Debian Squeeze or the upcoming Debian Buster ?

By comparison, Ubuntu and Fedora have a nice security features matrix, but I couldnt find a clear answer for Debian.

• Ubuntu: https://wiki.ubuntu.com/Security/Features
• Fedora: https://fedoraproject.org/wiki/Security_Features_Matrix

Answer 1

you can check if a binary is compiled with

1. PIE
2. stack protection
3. fortify source
4. RO relocations
5. Immediate binding

by using hardening-check. E.g. hardening-check $(which sshd) Package devscripts contains the hardening-check

On Debian testing i get the following output:

root@root:~# hardening-check $(which sshd)
/usr/sbin/sshd
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected funcions found)
Read-only relocations: yes
Immediate binding: yes

See the following answer on stackexchange