Re: F38 proposal: Add _FORTIFY_SOURCE=3 to distribution build flags (System-Wide Change proposal)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Dec 06, 2022 at 01:35:04AM +0100, Jaroslav Prokop wrote:
> On 12/5/22 20:58, Ben Cotton wrote:
> 
>     The core change to bring in this mitigation is to change the default
>     build flags in `redhat-rpm-config` so that packages build by default
>     with `-Wp,-D_FORTIFY_SOURCE=3`. There are packages (e.g. `systemd`)
>     that do not interact well with `_FORTIFY_SOURCE` and will also need a
>     workaround to downgrade fortification to level 2. The change will also
>     include this override.
> 
> How come systemd gets an exception? If it is a security option, it should be
> enabled everywhere.

I don't believe the proposal is that everyone *has* to use this (or at
least, I hope not).  Even existing _FORTIFY_SOURCE=2 is optional.  I'd
like to know what the problems are that affect systemd however.

> I do not see benefit in a security change that ignores PID 1 process,

I agree we should try to cover it.

> If the feature, on the GCC side, is not 100% done.
> How do I tell a difference of a bug with the _FORTIFY_SOURCE which I will
> ignore and a bug with my package?

By looking at the message printed out when the program crashes, I
guess?  And if that's not enough information, then asking here.

> I do not have the knowledge or the time to be able to say that GCC
> generated the wrong machine code and therefore it is not a bug with
> my package.  If my program was not complaining before the change and
> is now complaining with the change, I am opting out of the change,
> and filing a bug against GCC on Fedora.

GCC & Fedora developers have been very responsive on these kinds of
issues in the past.  No one wants a compiler with code gen problems.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
nbdkit - Flexible, fast NBD server with plugins
https://gitlab.com/nbdkit/nbdkit
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux