Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 21 Mar 2019 at 07:23, Tomasz Kłoczko <kloczko.tomasz@xxxxxxxxx> wrote:
>
> On Thu, 21 Mar 2019 at 09:07, Zbigniew Jędrzejewski-Szmek
> <zbyszek@xxxxxxxxx> wrote:
> [..]
> > The effect of "-Wformat -Wformat-security" without -Werror is only more warnings.
> > Unfortunately -Wformat will generate spurious warnings if the code is
> > not careful to give additional information to the compiler with
> > __attribute__((__format__(printf))) and friends. And even that sometimes
> > not enough, and explicit #pragma GCC diagnostic ignored "-Wformat-nonliteral"
> > is needed. So all in all, it is totally expected that code which is not
> > written with recent gcc in mind will generate spurious format warnings, even
> > if the code is completely OK. So turning this on will make builds more
> > noisy, and possibly break projects which use -Werror.
>
> Even gcc themselves "is not written with recent gcc in mind".
>
> $ grep '\[\-W' gcc.log| awk -F\[ '{print $2}'|awk -F\] '{print
> $1}'|sort | uniq -c | sort -nr| head -n 20
>     485 -Wmissing-profile
>     106 -Wformat-security
>      81 -Wmaybe-uninitialized
>      44 -Wimplicit-fallthrough=
>      24 -Wunused-function
>      20 -Wpointer-sign
>      20 -Wimplicit-function-declaration
>      19 -Wstringop-truncation
>       8 -Wformat-truncation=
>       8 -Wcast-qual
>       7 -Wcast-function-type
>       4 -Wcpp
>       4 -Wbuiltin-declaration-mismatch
>       3 -Wparentheses
>       2 -Wunused-value
>       2 -Wunused-parameter
>       2 -Wmissing-prototypes
>       2 -Wmisleading-indentation
>       2 -Wint-to-pointer-cast
>       2 -Wdiscarded-qualifiers
>
> BTW: each Fedora package build should have as part of the build report
> something like above.
>

Could you explain why it should? I am not sure what those flags
actually mean and why it would tell me anything about a package build.
If upstream decides that libX needs to be compiled with
-Wmissing-prototypes but nothing else.. what is it to me?


> kloczek
> --
> Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH
> _______________________________________________
> devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx



-- 
Stephen J Smoogen.
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux