1 |
commit: 469c078b8ada3bc00da386bd2eaa2dc3410e3323 |
2 |
Author: Sam James <sam <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Dec 28 19:33:34 2022 +0000 |
4 |
Commit: Sam James <sam <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Jan 1 21:16:42 2023 +0000 |
6 |
URL: https://gitweb.gentoo.org/data/gentoo-news.git/commit/?id=469c078b |
7 |
|
8 |
2023-01-01-hardening-fortify-assertions: add item |
9 |
|
10 |
Bug: https://bugs.gentoo.org/876893 |
11 |
Bug: https://bugs.gentoo.org/876895 |
12 |
Signed-off-by: Sam James <sam <AT> gentoo.org> |
13 |
|
14 |
.../2023-01-01-hardening-fortify-assertions.en.txt | 57 ++++++++++++++++++++++ |
15 |
1 file changed, 57 insertions(+) |
16 |
|
17 |
diff --git a/2023-01-01-hardening-fortify-assertions/2023-01-01-hardening-fortify-assertions.en.txt b/2023-01-01-hardening-fortify-assertions/2023-01-01-hardening-fortify-assertions.en.txt |
18 |
new file mode 100644 |
19 |
index 0000000..dfe9127 |
20 |
--- /dev/null |
21 |
+++ b/2023-01-01-hardening-fortify-assertions/2023-01-01-hardening-fortify-assertions.en.txt |
22 |
@@ -0,0 +1,57 @@ |
23 |
+Title: Hardened profiles improvements |
24 |
+Author: Sam James <sam@g.o> |
25 |
+Posted: 2023-01-01 |
26 |
+Revision: 1 |
27 |
+News-Item-Format: 2.0 |
28 |
+Display-If-Profile: features/hardened |
29 |
+Display-If-Profile: default/linux/ppc64le/17.0/musl/hardened |
30 |
+Display-If-Profile: default/linux/ppc/17.0/musl/hardened |
31 |
+Display-If-Profile: default/linux/amd64/17.0/no-multilib/hardened |
32 |
+Display-If-Profile: default/linux/amd64/17.0/hardened |
33 |
+Display-If-Profile: default/linux/amd64/17.0/musl/hardened |
34 |
+Display-If-Profile: default/linux/amd64/17.1/hardened |
35 |
+Display-If-Profile: default/linux/amd64/17.1/no-multilib/hardened |
36 |
+Display-If-Profile: default/linux/x86/17.0/hardened |
37 |
+Display-If-Profile: default/linux/arm/17.0/musl/armv7a/hardened |
38 |
+Display-If-Profile: default/linux/arm/17.0/musl/armv6j/hardened |
39 |
+Display-If-Profile: default/linux/arm/17.0/armv7a/hardened |
40 |
+Display-If-Profile: default/linux/arm/17.0/armv6j/hardened |
41 |
+Display-If-Profile: default/linux/ppc64/17.0/musl/hardened |
42 |
+Display-If-Profile: default/linux/arm64/17.0/hardened |
43 |
+Display-If-Profile: default/linux/arm64/17.0/musl/hardened |
44 |
+ |
45 |
+Gentoo's hardened profiles are adopting two new modern toolchain hardening |
46 |
+techniques: |
47 |
+1. Level 3 fortification (-D_FORTIFY_SOURCE=3) [0] |
48 |
+2. libstdc++ assertions (-D_GLIBCXX_ASSERTIONS) [1] |
49 |
+ |
50 |
+These will both be enabled by default with USE=hardened on sys-devel/gcc |
51 |
+for >=sys-devel/gcc-12.2.1_p20221224-r1. |
52 |
+ |
53 |
+To view the existing list of hardening changes applied by the profiles, |
54 |
+see the wiki [2]. |
55 |
+ |
56 |
+Stable users may wish to add sys-devel/gcc-12.2.1_p20221224-r1 into |
57 |
+/etc/portage/package.accept_keywords if they wish to take advantage |
58 |
+of these improvements early, before GCC 12 is marked stable. |
59 |
+ |
60 |
+## Migration |
61 |
+ |
62 |
+To fully take advantage of these new settings, GCC must first |
63 |
+be upgraded, and then all packages must be re-emerged: |
64 |
+1. emerge --sync |
65 |
+2. emerge --verbose --oneshot ">=sys-devel/gcc-12.2.1_p20221224-r1" |
66 |
+3. emerge --verbose --emptytree @world |
67 |
+ |
68 |
+## Troubleshooting |
69 |
+ |
70 |
+In the event that some packages fail at runtime, please file a bug |
71 |
+with the full details. To temporarily workaround the problem, |
72 |
+it should be possible to recompile broken packages with the |
73 |
+following *FLAGS: |
74 |
+CFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" |
75 |
+CXXFLAGS="${CXXFLAGS} -D_FORTIFY_SOURCE=2 -U_GLIBCXX_ASSERTIONS" |
76 |
+ |
77 |
+[0] https://bugs.gentoo.org/876893 |
78 |
+[1] https://bugs.gentoo.org/876895 |
79 |
+[2] https://wiki.gentoo.org/wiki/Hardened/Toolchain#Changes |