Bump version to 0.4.7

[novacoin.git] / doc / build-unix.txt

diff --git a/doc/build-unix.txt b/doc/build-unix.txt
index 0c4e88e..e608c25 100644 (file)
--- a/doc/build-unix.txt
+++ b/doc/build-unix.txt
@@ -25,15 +25,14 @@ Dependencies
 sudo apt-get install build-essential
 sudo apt-get install libgtk2.0-dev
 sudo apt-get install libssl-dev
-sudo apt-get install libdb4.7-dev
-sudo apt-get install libdb4.7++-dev
+sudo apt-get install libdb4.8-dev
+sudo apt-get install libdb4.8++-dev
 Boost 1.40+: sudo apt-get install libboost-all-dev
 or Boost 1.37: sudo apt-get install libboost1.37-dev
 
 If using Boost 1.37, append -mt to the boost libraries in the makefile.
 
-Requires wxWidgets 2.9.0 or greater, which uses UTF-8.  Don't try 2.8, it
-won't work.
+Requires wxWidgets 2.9.1 or newer.
 
 You need to download wxWidgets from http://www.wxwidgets.org/downloads/
 and build it yourself.  See the build instructions and configure parameters
@@ -55,10 +54,10 @@ miniupnpc      New (3-clause) BSD license
 Versions used in this release:
 GCC          4.3.3
 OpenSSL      0.9.8g
-wxWidgets    2.9.0
-Berkeley DB  4.7.25.NC
+wxWidgets    2.9.2
+Berkeley DB  4.8.30.NC
 Boost        1.37
-miniupnpc    1.5
+miniupnpc    1.6
 
 
 Notes
@@ -74,8 +73,8 @@ symbols, which reduces the executable size by about 90%.
 wxWidgets
 ---------
 cd /usr/local
-tar -xzvf wxWidgets-2.9.0.tar.gz
-cd wxWidgets-2.9.0
+tar -xzvf wxWidgets-2.9.2.tar.gz
+cd wxWidgets-2.9.2
 mkdir buildgtk
 cd buildgtk
 ../configure --with-gtk --enable-debug --disable-shared --enable-monolithic --without-libpng --disable-svg
@@ -87,8 +86,8 @@ ldconfig
 
 miniupnpc
 ---------
-tar -xzvf miniupnpc-1.5.tar.gz
-cd miniupnpc-1.5
+tar -xzvf miniupnpc-1.6.tar.gz
+cd miniupnpc-1.6
 make
 sudo su
 make install
@@ -96,8 +95,7 @@ make install
 
 Berkeley DB
 -----------
-You need Berkeley DB 4.7.  Don't use 4.8, the database/log0000* files
-are incompatible.  If you have to build Berkeley DB yourself:
+You need Berkeley DB 4.8.  If you have to build Berkeley DB yourself:
 ../dist/configure --enable-cxx
 make
 
@@ -108,3 +106,45 @@ If you need to build Boost yourself:
 sudo su
 ./bootstrap.sh
 ./bjam install
+
+
+Security
+--------
+To help make your bitcoin installation more secure by making certain attacks impossible to
+exploit even if a vulnerability is found, you can take the following measures:
+
+* Position Independent Executable
+    Build position independent code to take advantage of Address Space Layout Randomization
+    offered by some kernels. An attacker who is able to cause execution of code at an arbitrary
+    memory location is thwarted if he doesn't know where anything useful is located.
+    The stack and heap are randomly located by default but this allows the code section to be
+    randomly located as well.
+
+    On an Amd64 processor where a library was not compiled with -fPIC, this will cause an error
+    such as: "relocation R_X86_64_32 against `......' can not be used when making a shared object;"
+
+    To build with PIE, use:
+    make -f makefile.unix ... -e PIE=1
+
+    To test that you have built PIE executable, install scanelf, part of paxutils, and use:
+    scanelf -e ./bitcoin
+
+    The output should contain:
+     TYPE
+    ET_DYN
+
+* Non-executable Stack
+    If the stack is executable then trivial stack based buffer overflow exploits are possible if
+    vulnerable buffers are found. By default, bitcoin should be built with a non-executable stack
+    but if one of the libraries it uses asks for an executable stack or someone makes a mistake
+    and uses a compiler extension which requires an executable stack, it will silently build an
+    executable without the non-executable stack protection.
+
+    To verify that the stack is non-executable after compiling use:
+    scanelf -e ./bitcoin
+
+    the output should contain:
+    STK/REL/PTL
+    RW- R-- RW-
+
+    The STK RW- means that the stack is readable and writeable but not executable.