[gentoo-dev] Re: Improve the security of the default profile

[Ryan Hill <dirtyepic@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1524 bytes --]

On Tue, 10 Sep 2013 18:41:34 -0400
Richard Yao <ryao@gentoo.org> wrote:

> A few thoughts:
> 
> 1. The kernel expects -fno-stack-protector to be the default. What will
> the effect be on kernel configuration once -fstack-protector is the default?

The kernel has supported building with -fstack-protector since 2.6.19, (at least
on x86/x86-64).  It's controlled by CONFIG_CC_STACKPROTECTOR and if it's
disabled then -fno-stack-protector is explicitly added to the command line.

> 2. We should make sure that -fno-stack-protector is a supported CFLAG.
> This will make it easier to handle complaints from the vocal minority of
> our user base that want every last percentage point of performance.

If by supported you mean that they won't be removed by things like strip-flags,
then yes, -fstack-protector -fstack-protector-all -fno-stack-protector and
-fno-stack-protector-all are all on the whitelist.

> 3. I would like to point out that we are talking about deviating from
> upstream behavior and everyone is okay with it. Anyone who thinks we
> should stick to upstream when it is not good for us should speak now or
> risk being asked "where were you when..." whenever they try to use
> upstream as an excuse to hold back progress. ;)

In this case it seems every other distro is already doing this, so we're in
good company.


-- 
Ryan Hill                        psn: dirtyepic_sk
   gcc-porting/toolchain/wxwidgets @ gentoo.org

47C3 6D62 4864 0E49 8E9E  7F92 ED38 BD49 957A 8463

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 490 bytes --]