[gentoo-dev] Re: [RFC] News item: GCC 6 defaults to USE="pie ssp"

[Martin Vaeth]

Hanno Böck <hanno@g.o> wrote:
> I really think it's about time that pie becomes the default in Gentoo.

Although I agree from a security perspective, I must warn that
this is not realistic, currently:

I am using gcc-6 since ages and tried to run a desktop with default pie
for quite a while, but soon was forced to give up:

There are simply too many package which fail to compile;
this cannot even be recommended to early testers yet, not to speak
about the wide public.

The difficulty is not the static libraries
(which except for embedded systems are hardly needed at all),
but simply that too many projects are not prepared for this.

The main problem is that it is not easy (as it was for the hardened gcc)
to switch the compiler profiles if you have a non-working project:
If a project fails to emerge and does not honour CFLAGS throughout -
there simply are quite a lot of projects which do neither -
the user either has to write/get some patch manually or he has to
re-emerge gcc just in order to compile/update that single project.

For instance, you cannot even compile the kernel without special patches
(which disable pie) if you use a gcc which default-enables pie.

Thus, unless practically all upstream projects deal with pie or unless
gentoo manages to get a huge group of persons which patches all new releases
of upstream projects to this purpose very quickly - both is not realistic,
of course - using pie by default is a no-go for "normal" systems:
Perhaps some very hardened servers with only very few packages and
a very active administrator can afford to do this, but not "normal"
users who run a desktop.