On 1/11/22 13:00, Steve Grubb wrote: > Hello, > > On Wednesday, January 5, 2022 5:05:26 PM EST Ben Cotton wrote: >> https://fedoraproject.org/wiki/Changes/GNUToolchainF36 >> >> == Summary == >> Update the Fedora 36 GNU Toolchain to gcc 12 and glibc 2.35. >> >> The gcc 12 is currently under development and will be included in >> Fedora 36 upon release. The glibc 2.35 change will be tracked in this >> top-level GNU Toolchain system-wide update. > > Reading through the GCC 12 changes, there is a significant new feature to GCC > that would appear to be useful for security. There is a new: > > -ftrivial-auto-var-init=zero > > flag that initializes all stack variables to zero. Zero being a nice safe > value that makes programs crash instead of being exploitable. > > Are there plans to enable this flag so that all applications, but more > importantly the kernel, are hardened against uninitialized stack variables? > This is one of the major classes of security bugs that could potentially be > eliminated during this mass rebuild. There are currently no plans that I am aware of that involve turning on '-ftrivial-auto-var-init=zero' in the short term for Fedora. CC'ing Jakub and Marek to comment. It is something that should be discussed, turned on in Rawhide first, and likely via redhat-rpm-config default flags first, and then we should fix any fallout. I'd only be comfortable if we did it early and worked through the consequences. So it could be something to discuss for F37. -- Cheers, Carlos. _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
