| 1 |
torsdag 09 januari 2014 23.18.28 skrev Ryan Hill: |
| 2 |
> On Thu, 09 Jan 2014 21:58:46 +0100 |
| 3 |
> |
| 4 |
> Magnus Granberg <zorry@g.o> wrote: |
| 5 |
> > Some time ago we discussed that we should enable stack smashing |
| 6 |
> > (-fstack-protector) by default. So we opened a bug to track this [1]. |
| 7 |
> > The affected Gcc version will be 4.8.2 and newer. Only amd64, x86, mips, |
| 8 |
> > ppc, ppc64 and arm will be affected by this change. |
| 9 |
> > |
| 10 |
> > You can turn off ssp by using the nossp USE flag or by adding |
| 11 |
> > -fno-stack-protector to the CFLAGS and/or CXXFLAGS. We are using the same |
| 12 |
> > patch as Debian/Ubuntu but with some Gentoo fixes. |
| 13 |
> > |
| 14 |
> > The patch will move the sed for the HARD_CFLAGS, ALLCFLAGS and |
| 15 |
> > ALLCXXFLAGS from do_gcc_PIE_patches() to make_gcc_hard(). We will |
| 16 |
> > make_gcc_hard() the default for all Gcc versions 4.8 and newer, and turn |
| 17 |
> > it on or off with hardened_gcc_works() that will make some sanity checks. |
| 18 |
> |
| 19 |
> I went ahead and spun a new patchset for the compiler-side stuff if anyone |
| 20 |
> wants to start playing around. |
| 21 |
> |
| 22 |
> - apply the eclass patch from bug #484714 (the one attached to Magnus' email |
| 23 |
> wouldn't apply for me but maybe my mailer mangled it) |
| 24 |
> - in gcc-4.8.2.ebuild do: |
| 25 |
> |
| 26 |
> -PATCH_VER="1.3" |
| 27 |
> +PATCH_VER="1.4-ssptest" |
| 28 |
> |
| 29 |
> -PIE_VER="0.5.8" |
| 30 |
> +PIE_VER="0.5.9-ssptest" |
| 31 |
> |
| 32 |
> BTW Magnus, thanks for doing this. |
| 33 |
Hi |
| 34 |
Have patched toolchain.eclass with the patch and with your change. |
| 35 |
Updated 4.8.2 updated with the needed changes and commit it. |
| 36 |
The use hardened && gcc-specs-ssp && append-cflags $(test-flags-CC -fno-stack- |
| 37 |
protector) in glibc's common.eblit is fixed to. |
| 38 |
So default ssp is out in the tree :) |
| 39 |
/Magnus |
Archives