[gentoo-dev] Enable format-security in the dev profiles

[gentoo-dev] Enable format-security in the dev profiles

[Agostino Sarubbo]

[-- Attachment #1: Type: text/plain, Size: 251 bytes --]

Hello,

I'd like to enable by default format-security at least in the 
dev profiles.

Thought?

References:
https://bugs.gentoo.org/show_bug.cgi?id=259417
https://fedoraproject.org/wiki/Format-Security-FAQ

-- 
Agostino Sarubbo
Gentoo Linux Developer

[-- Attachment #2: Type: text/html, Size: 2370 bytes --]

Re: [gentoo-dev] Enable format-security in the dev profiles

[Jeroen Roovers]

On Sun, 20 Jul 2014 21:28:31 +0200
Agostino Sarubbo <ago@gentoo.org> wrote:

> Hello,
> 
> I'd like to enable by default format-security at least in the 
> dev profiles.
> 
> Thought?
> 
> References:
> https://bugs.gentoo.org/show_bug.cgi?id=259417

Read comment #0. It's been enabled by default for ages. AFAICT a version
with format-security (and other assorted warnings) enabled by
default first went stable just about four years ago (bug #302468).


     jer

Re: [gentoo-dev] Enable format-security in the dev profiles

[Jeroen Roovers]

On Mon, 21 Jul 2014 01:48:49 +0200
Jeroen Roovers <jer@gentoo.org> wrote:

> On Sun, 20 Jul 2014 21:28:31 +0200
> Agostino Sarubbo <ago@gentoo.org> wrote:
> 
> > Hello,
> > 
> > I'd like to enable by default format-security at least in the 
> > dev profiles.
> > 
> > Thought?
> > 
> > References:
> > https://bugs.gentoo.org/show_bug.cgi?id=259417

Oh, you meant -Werror=format-security. Bug #259417 is about
-Wformat-security.


     jer

Re: [gentoo-dev] Enable format-security in the dev profiles

[Samuli Suominen]

On 20/07/14 22:28, Agostino Sarubbo wrote:
>
> Hello,
>
>  
>
> I'd like to enable by default format-security at least in the dev
> profiles.
>
>  
>
> Thought?
>
>  
>
> References:
>
> https://bugs.gentoo.org/show_bug.cgi?id=259417
>
> https://fedoraproject.org/wiki/Format-Security-FAQ
>
>  
>
> -- 
>
> Agostino Sarubbo
>
> Gentoo Linux Developer
>

Why not generate a Portage QA warning out from the warning
-Wformat-security produces instead?
That way compile wouldn't abort needlessly.

Re: [gentoo-dev] Enable format-security in the dev profiles

["Paweł Hajdan, Jr."]

[-- Attachment #1: Type: text/plain, Size: 248 bytes --]

On 7/21/14, 6:02 AM, Samuli Suominen wrote:
> Why not generate a Portage QA warning out from the warning
> -Wformat-security produces instead?
> That way compile wouldn't abort needlessly.

+1, and then it can be done globally.

Paweł



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 841 bytes --]

Re: [gentoo-dev] Enable format-security in the dev profiles

[Diego Elio Pettenò]

[-- Attachment #1: Type: text/plain, Size: 605 bytes --]

Any -Werror=* flag will make random autoconf checks fail for no good
reason, don't use them on profiles, it's silly.

Diego Elio Pettenò — Flameeyes
flameeyes@flameeyes.eu — http://blog.flameeyes.eu/


On 20 July 2014 20:28, Agostino Sarubbo <ago@gentoo.org> wrote:

>  Hello,
>
>
>
> I'd like to enable by default format-security at least in the dev profiles.
>
>
>
> Thought?
>
>
>
> References:
>
> https://bugs.gentoo.org/show_bug.cgi?id=259417
>
> https://fedoraproject.org/wiki/Format-Security-FAQ
>
>
>
> --
>
> Agostino Sarubbo
>
> Gentoo Linux Developer
>

[-- Attachment #2: Type: text/html, Size: 2528 bytes --]

Re: [gentoo-dev] Enable format-security in the dev profiles

[Agostino Sarubbo]

[-- Attachment #1: Type: text/plain, Size: 402 bytes --]

On Monday 21 July 2014 10:08:44 Diego Elio Pettenò wrote:
> Any -Werror=* flag will make random autoconf checks fail 
for no good
> reason, don't use them on profiles, it's silly.
> 
> Diego Elio Pettenò — Flameeyes
> flameeyes@flameeyes.eu — http://blog.flameeyes.eu/

I don't see where I asked about -Werror instead of only -
Wformat.

-- 
Agostino Sarubbo
Gentoo Linux Developer

[-- Attachment #2: Type: text/html, Size: 2367 bytes --]

Re: [gentoo-dev] Enable format-security in the dev profiles

[Ian Stakenvicius]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 21/07/14 11:07 AM, Agostino Sarubbo wrote:
> On Monday 21 July 2014 10:08:44 Diego Elio Pettenò wrote:
> 
>> Any -Werror=* flag will make random autoconf checks fail for no
>> good
> 
>> reason, don't use them on profiles, it's silly.
> 
>> 
> 
>> Diego Elio Pettenò — Flameeyes
> 
>> flameeyes@flameeyes.eu — http://blog.flameeyes.eu/
> 
> 
> 
> I don't see where I asked about -Werror instead of only -Wformat.
> 

You didn't, explicitly; jer mentioned -Werror because -Wformat has
been enabled for years already (his words), so the assumption was that
you meant -Werror and Diego is responding to that.

(Diego's post was against the OP, so out-of-order, is all)


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iF4EAREIAAYFAlPNLZ4ACgkQ2ugaI38ACPC40wEAhd7g3fuOewsbszeQhXb7F9t3
XHdhEB79CMhZ7eIIT3MA/iAJfDPxAVVkOQE3GoOQ8sUQMvFG+jY+3lmB6vzzjMQs
=Q+Re
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Enable format-security in the dev profiles

[Agostino Sarubbo]

[-- Attachment #1: Type: text/plain, Size: 396 bytes --]

On Monday 21 July 2014 08:52:51 Paweł Hajdan, Jr. wrote:
> On 7/21/14, 6:02 AM, Samuli Suominen wrote:
> > Why not generate a Portage QA warning out from the warning
> > -Wformat-security produces instead?
> > That way compile wouldn't abort needlessly.
> 
> +1, and then it can be done globally.
> 
> Paweł

This is fine for me too.

-- 
Agostino Sarubbo
Gentoo Linux Developer

[-- Attachment #2: Type: text/html, Size: 2806 bytes --]

Re: [gentoo-dev] Enable format-security in the dev profiles

[Jeroen Roovers]

On Mon, 21 Jul 2014 17:07:24 +0200
Agostino Sarubbo <ago@gentoo.org> wrote:

> I don't see where I asked about -Werror instead of only -
> Wformat.

It's been enabled in stable GCC for four years and in unstable and the
hardened profiles for much longer so asking about setting it in any
profiles makes no sense.

In trying to make sense of what you were asking, I thought it might be
helpful to make mention of the -Werror=format-security that /you/ use
in your new bug reports that block bug #259417 now.


     jer

Re: [gentoo-dev] Enable format-security in the dev profiles

[Samuli Suominen]

On 21/07/14 18:11, Ian Stakenvicius wrote:
> On 21/07/14 11:07 AM, Agostino Sarubbo wrote:
> > On Monday 21 July 2014 10:08:44 Diego Elio Pettenò wrote:
>
> >> Any -Werror=* flag will make random autoconf checks fail for no
> >> good
>
> >> reason, don't use them on profiles, it's silly.
>
> >>
>
> >> Diego Elio Pettenò — Flameeyes
>
> >> flameeyes@flameeyes.eu — http://blog.flameeyes.eu/
>
>
>
> > I don't see where I asked about -Werror instead of only -Wformat.
>
>
> You didn't, explicitly; jer mentioned -Werror because -Wformat has
> been enabled for years already (his words), so the assumption was that
> you meant -Werror and Diego is responding to that.
>
> (Diego's post was against the OP, so out-of-order, is all)
>
>
>

But only -Wformat=2 has -Wformat-security. Do we enable -Wformat with 1
or 2?
I'm asking, I really don't know (and can't check immediately)

- Samuli

Re: [gentoo-dev] Enable format-security in the dev profiles

[Jeroen Roovers]

On Mon, 21 Jul 2014 18:55:25 +0300
Samuli Suominen <ssuominen@gentoo.org> wrote:

> But only -Wformat=2 has -Wformat-security. Do we enable -Wformat with
> 1 or 2?

The gcc info pages say:

`-Wformat'

[...]

    In Gentoo, this option is enabled by default for [...]

`-Wformat-security'

[...]

    In Gentoo, this option is enabled by default for [...]


The relevant patches are found in cvs/gentoo/src/patchsets/gcc/*/gentoo/
and are generally named

10_all_default-fortify-source.patch
11_all_default-warn-format-security.patch


     jer

Re: [gentoo-dev] Enable format-security in the dev profiles

[Pacho Ramos]

El lun, 21-07-2014 a las 17:22 +0200, Jeroen Roovers escribió:
> On Mon, 21 Jul 2014 17:07:24 +0200
> Agostino Sarubbo <ago@gentoo.org> wrote:
> 
> > I don't see where I asked about -Werror instead of only -
> > Wformat.
> 
> It's been enabled in stable GCC for four years and in unstable and the
> hardened profiles for much longer so asking about setting it in any
> profiles makes no sense.
> 
> In trying to make sense of what you were asking, I thought it might be
> helpful to make mention of the -Werror=format-security that /you/ use
> in your new bug reports that block bug #259417 now.
> 
> 
>      jer
> 

Is -Werror=format-security so prone to give false warnings currently? I
think Fedora and Ubuntu enabled it by default recently:
https://fedorahosted.org/fesco/ticket/1185
https://wiki.ubuntu.com/ToolChain/CompilerFlags#A-Wformat_-Wformat-security
https://bugzilla.redhat.com/show_bug.cgi?id=1043495