Bug 586296

Summary:	sys-kernel/hardened-sources: Cannot use CONFIG_CC_STACKPROTECTOR_STRONG
Product:	Gentoo Linux	Reporter:	Attila Tóth <atoth>
Component:	Hardened	Assignee:	The Gentoo Linux Hardened Team <hardened>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Attila Tóth 2016-06-18 16:32:42 UTC

I'm on a hardened toolchain. While trying to compile hardened-sources, I get the following warning:
Makefile:679: Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong not supported by compiler
This happens either using sys-devel/gcc-4.9.3, -5.3.0 or the latest -5.4.0 compiling sys-kernel/hardened-sources-4.5.5-r2, -4.5.6 or the latest -4.5.7-r1.
I always compile the kernel manually. I have a feeling that these warning are showing up only lately but I'm not exactly sure when they appeared first.
It also happens with CONFIG_CC_STACKPROTECTOR_REGULAR testing -fstack-protector...
These warning are basically bogus, since all aforementioned gccs take and understand fstack compiler flags on my system. I'm not sure what is the problem here. If I hardcode the flag in the Makefile, the kernel compiles flawlessly...

How can I make sure whether actually fstack-protector-strong gets used during the compilation of the kernel.

Comment 1 Georg Weiss 2016-07-11 20:47:41 UTC

happened to me too. seems to be fixed with latest hardened-sources (using 4.6.3 currently).

Comment 2 Attila Tóth 2016-07-11 21:36:42 UTC

(In reply to Georg Weiss from comment #1)
> happened to me too. seems to be fixed with latest hardened-sources (using
> 4.6.3 currently).

For now I hardwired strong with a custom trivial patch, but I'm still don't know any official way to check whether it is done right.
I roll my weekly update tomorrow, so I'll have a chance to test 4.6.3. I'll pay special attention.

Comment 3 Attila Tóth 2016-07-20 12:51:53 UTC

(In reply to Attila Tóth from comment #2)
> (In reply to Georg Weiss from comment #1)
> > happened to me too. seems to be fixed with latest hardened-sources (using
> > 4.6.3 currently).
> 
> For now I hardwired strong with a custom trivial patch, but I'm still don't
> know any official way to check whether it is done right.
> I roll my weekly update tomorrow, so I'll have a chance to test 4.6.3. I'll
> pay special attention.

I can no longer experience the symptom while compiling hardened-sources-4.6.3.

Comment 4 Anthony Basile gentoo-dev

2016-07-21 16:37:21 UTC

it appears to be fixed.