Bug 645450 – dev-db/mariadb: does not respect CFLAGS (fno-stack-protector)

• Status: CONFIRMED
• Product: Gentoo Linux

[Description Agostino Sarubbo 2018-01-23 13:37:14 UTC]

While is good for a security purpose, the package does not respect the fno-stack-protector CFLAG
To test, compile it with CFLAGS/CXXFLAGS fno-stack-protector and run:
checksec --file /usr/sbin/mysqld

The checksec command line tool is from app-admin/checksec.

It is also overwriting the fortify_source flag

[Comment 1 Brian Evans 2018-01-23 14:04:42 UTC]

Beginning in MariaDB 10.1, the option SECURITY_HARDENED [1]  was added to always set pie, PIC, -fstack-protector, and -D_FORTIFY_SOURCE=2 when the compiler version was >= 4.6.

If this is unwanted, I could certainly force it off.

I did not consider it previously as it seemed to be doing the right thing.

[1] https://github.com/MariaDB/server/blob/10.1/CMakeLists.txt#L217

[Comment 2 Brian Evans 2018-05-18 19:38:03 UTC]

Marking this NEEDINFO until there is a response on the best course of action

[Comment 3 Agostino Sarubbo 2018-05-19 14:12:18 UTC]

Is fine have those flags, but the user's flags should be passed after the build system flags so they can be overwritten.