On Sat, May 23, 2020 at 11:59 AM William Roberts <bill.c.roberts@xxxxxxxxx> wrote: > > On Sat, May 23, 2020 at 5:57 AM Laurent Bigonville <bigon@xxxxxxxxxx> wrote: > > > > Hello, > > > > The current build system of the userspace is setting a lot of CFLAGS, > > but most of these are overridden by the distributions when building. > > > > Today I received a bug report[0] from Christian Göttsche asking me to > > set -fno-semantic-interposition again in libsepol. I see also the same > > flag and also a lot of others set in libselinux and libsemanage build > > system. > > Why would it be again? The old DSO design made that option impotent. > Clang does it by default. > > > > > For what I understand some of these are just needed for code quality > > (-W) and could be controlled by distributions but others might actually > > need to be always set (-f?). > > If you look at the Makefiles overall in all the projects, you'll see hardening > flags, etc. Libsepol has a pretty minimal set compared to say libselinux, but > they all get overridden by build time CFLAGS if you want. > > > > > Shouldn't the flags that always need to be set (which ones?) be moved to > > a "override CFLAGS" directive to avoid these to be unset by distributions? > > If you we're cleaver with CFLAGS before, you could acually circumvent > the buildtime > DSO stuff. While i'm not opposed to adding it to immutable flag, if > you're setting > CFLAGS, you're on your own. At least with the current design. > > I have no issues with adding it to override, but we would have to > overhaul a bunch > of them and make them consistent. I'm inclined to agree with Laurent here - we should always set this flag in order to preserve the same behavior prior to the patches that removed hidden_def/hidden_proto and switched to relying on this instead.
