Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 851111 - sys-devel/clang: enable SSP, FORTIFY_SOURCE=2 by default
Summary: sys-devel/clang: enable SSP, FORTIFY_SOURCE=2 by default
Status: CONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-06-11 02:11 UTC by Sam James
Modified: 2022-11-08 03:06 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-06-11 02:11:59 UTC
Just like we do with GCC. Just filing this so I don't forget about it.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-06-18 00:56:37 UTC
I have vague recollection of us wanting to do this using the config file support.

Alternatively, we just patch it in like we do for GCC.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-06-27 02:07:59 UTC
Given https://lists.llvm.org/pipermail/cfe-dev/2015-November/045852.html, I'm not sure if we want to bother with the F_S stuff for Clang.
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-09-13 21:36:45 UTC
(In reply to Sam James from comment #1)
> I have vague recollection of us wanting to do this using the config file
> support.
> 
> Alternatively, we just patch it in like we do for GCC.

See https://discourse.llvm.org/t/rfc-adding-a-default-file-location-to-config-file-support/63606/23.
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-11-08 03:06:24 UTC
Updating this after a prompt from Arfrever:
- We could switch PIE from USE=pie on clang into clang-common
- We can do SSP in clang-common too, I think
- We still have to do FORTFIY_SOURCE in Clang itself because it requires >= -O1 (can't pass it unconditionally)