Bug 101113 – emerging glibc fails if -fstack-protector-all is present in CFLAGS

• Status: RESOLVED WONTFIX
• Product: Gentoo Linux

[Description nefercheprure 2005-08-02 10:52:10 UTC]

i686-pc-linux-gnu-gcc ../sysdeps/unix/sysv/linux/ssp.c -c -std=gnu99 -O2 -Wall
-Winline -Wstrict-prototypes -Wwrite-strings -fstack-protector-all
-mtune=pentium-m -mtune=pentium3 -pipe -mpreferred-stack-boundary=4  -g0 -O99
-fomit-frame-pointer -D__USE_STRING_INLINES -fno-stack-protector   -I../include
-I.
-I/var/tmp/portage/glibc-2.3.5/work/build-default-i686-pc-linux-gnu-linuxthreads/csu
-I.. -I../libio 
-I/var/tmp/portage/glibc-2.3.5/work/build-default-i686-pc-linux-gnu-linuxthreads
-I../sysdeps/i386/elf -I../linuxthreads/sysdeps/unix/sysv/linux/i386
-I../linuxthreads/sysdeps/unix/sysv/linux -I../linuxthreads/sysdeps/pthread
-I../sysdeps/pthread -I../linuxthreads/sysdeps/unix/sysv
-I../linuxthreads/sysdeps/unix -I../linuxthreads/sysdeps/i386/i686
-I../linuxthreads/sysdeps/i386 -I../libidn/sysdeps/unix
-I../sysdeps/unix/sysv/linux/i386 -I../sysdeps/unix/sysv/linux -I../sysdeps/gnu
-I../sysdeps/unix/common -I../sysdeps/unix/mman -I../sysdeps/unix/inet
-I../sysdeps/unix/sysv/i386 -I../sysdeps/unix/sysv -I../sysdeps/unix/i386
-I../sysdeps/unix -I../sysdeps/posix -I../sysdeps/i386/i686/fpu
-I../sysdeps/i386/i686 -I../sysdeps/i386/i486 -I../sysdeps/i386/fpu
-I../sysdeps/i386 -I../sysdeps/wordsize-32 -I../sysdeps/ieee754/ldbl-96
-I../sysdeps/ieee754/dbl-64 -I../sysdeps/ieee754/flt-32 -I../sysdeps/ieee754
-I../sysdeps/generic/elf -I../sysdeps/generic -nostdinc -isystem
/usr/lib/gcc/i686-pc-linux-gnu/3.4.3/include -isystem /usr/include
-D_LIBC_REENTRANT -include ../include/libc-symbols.h       -DHAVE_INITFINI -o
/var/tmp/portage/glibc-2.3.5/work/build-default-i686-pc-linux-gnu-linuxthreads/csu/ssp.o
-MD -MP -MF
/var/tmp/portage/glibc-2.3.5/work/build-default-i686-pc-linux-gnu-linuxthreads/csu/ssp.o.dt
-MT
/var/tmp/portage/glibc-2.3.5/work/build-default-i686-pc-linux-gnu-linuxthreads/csu/ssp.o
../sysdeps/unix/sysv/linux/ssp.c:24:3: #error ssp.c has to be built w/
-fno-stack-protector
make[2]: ***
[/var/tmp/portage/glibc-2.3.5/work/build-default-i686-pc-linux-gnu-linuxthreads/csu/ssp.o]
Error 1

[Comment 1 nefercheprure 2005-08-02 11:06:08 UTC]

Created attachment 64946 [details, diff]
fix for the bug ... a patch against /usr/portage/sys-libs/glibc/files/2.3.5/glibc-2.3.5-propolice-guard-functions.patch

The file glibc-2.3.5-propolice-guard-functions.patch that adds the ssp.c to the
makefiles handles the case of -fstack-protector being present in CFLAGS

This modification handles the case of -fstack-protector-all being present in
CFLAGS.

[Comment 2 Kevin F. Quinn (RETIRED) 2005-08-02 22:59:51 UTC]

This is not enough.  You also need to take off -fstack-protector(-all) on a
bunch of other stuff.  It's easier (and supported) to use the hardened gcc for
this, rather than putting -fstack-protector or -fstack-protector-all in your CFLAGS.

[Comment 3 nefercheprure 2005-08-04 01:55:47 UTC]

Removing -fstack-protector-all from the CFLAGS makes the emerge succeed.

In bug #99934 and bug #101145 (duplicate except for the comments), there was
another failure demonstrating itself as undefined references to certain symbols.

Changing the USE to contain nptl nptlonly produces another problem (file locking
is macro-expanded to an undeclared identifier). The problem vanishes when
-fstack-protector-all is removed from the CFLAGS.

With all these in mind, I would propose adding "Do not add -fstack-protector-all
or -fstack-protector to the CFLAGS, use hardened gcc instead." to the comments
in the /etc/make.conf file.

The bug can be considered fixed (or workarounded) then.

[Comment 4 Mark Loeser (RETIRED) 2005-12-15 23:56:07 UTC]

Hardened doesn't support sticking -fstack-protector in your CFLAGS since it
breaks things like this.