Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Mar 21, 2019 at 11:43:49AM +0000, Tomasz Kłoczko wrote:
> On Thu, 21 Mar 2019 at 11:37, Stephen John Smoogen <smooge@xxxxxxxxx> wrote:
> [..]
> > > Even gcc themselves "is not written with recent gcc in mind".
> > >
> > > $ grep '\[\-W' gcc.log| awk -F\[ '{print $2}'|awk -F\] '{print
> > > $1}'|sort | uniq -c | sort -nr| head -n 20
> > >     485 -Wmissing-profile
> > >     106 -Wformat-security
> > >      81 -Wmaybe-uninitialized
> > >      44 -Wimplicit-fallthrough=
> > >      24 -Wunused-function
> > >      20 -Wpointer-sign
> > >      20 -Wimplicit-function-declaration
> > >      19 -Wstringop-truncation
> > >       8 -Wformat-truncation=
> > >       8 -Wcast-qual
> > >       7 -Wcast-function-type
> > >       4 -Wcpp
> > >       4 -Wbuiltin-declaration-mismatch
> > >       3 -Wparentheses
> > >       2 -Wunused-value
> > >       2 -Wunused-parameter
> > >       2 -Wmissing-prototypes
> > >       2 -Wmisleading-indentation
> > >       2 -Wint-to-pointer-cast
> > >       2 -Wdiscarded-qualifiers
> > >
> > > BTW: each Fedora package build should have as part of the build report
> > > something like above.
> > >
> >
> > Could you explain why it should? I am not sure what those flags
> > actually mean and why it would tell me anything about a package build.
> > If upstream decides that libX needs to be compiled with
> > -Wmissing-prototypes but nothing else.. what is it to me?
> 
> That list is not in order of importance but how often some warning
> happened, and I think that you are fully aware that on that list are
> things far more important than missing prototype.

Like what exactly?  E.g. all the -Wformat-security warnings are about cases
where the format strings are constructed shortly before they are passed to
the format attribute functions, either unmodified or through gettext.
In no case any of that is from user provided strings.
I've tried several times to change that but it turned to be too ugly for no
real benefit.
-Wmissing-profile is just a matter of not 100% code coverage during
bootstrap when using FDO, not a bug.  What else?

GCC carefully uses -Werror with some -Wno- options in some parts of the
bootstrap on some parts of the codebases and not others for various reasons.

	Jakub
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux