Re: [gentoo-dev] how to turn off hardened gcc flags reliably?

[Kevin F. Quinn (Gentoo)]

On Thu, 02 Mar 2006 00:54:25 +0000
Duncan Coutts <dcoutts@g.o> wrote:

> On Thu, 2006-03-02 at 00:41 +0000, Roy Marples wrote:
> > For the non technically minded folks whats the difference between
> > -fno-stack-protector and -fno-stack-protector-all?
> [...]
> It was explained to me like this:
>
> -fno-stack-protector makes gcc use a heuristic to decide whether or
> not change a function to use stack-smashing protection.
>
> -fno-stack-protector-all makes gcc just do it for every function.

not quite (note the 'no-'!):

In gcc-3:

-fstack-protector switches on stack protection for functions that gcc
decides heuristically to be most vulnerable according to their
parameters and local data.

-fstack-protector-all switches on stack protection for (almost) all
functions

-fno-stack-protector switches off -fstack-protector

-fno-stack-protector-all switches off -fstack-protector-all

Of note is that:
... -fstack-protector -fstack-protector-all -fno-stack-protector
results in no ssp at all

... -fstack-protector -fstack-protector-all -fno-stack-protector-all
results in heuristic ssp switched on


For gcc-4.1, the semantics have changed as RedHat Did Their Own Thing
and broke backwards compatibility:
1) -fno-stack-protector-all does not exist
2) stack protection is viewed as a three-state setting configured by
the last occurring switch from the set

-fno-stack-protector  - no stack protection
-fstack-protector     - heuristic stack protection
-fstack-protector-all - stack protection on all functions

(imo they should have done something like -fstack-protect[N] for
N=0,1,2 which would have been clearer, but I got ignored when I
suggested it)

Since 'last option wins' in the RedHat version,

'-fstack-protector-all -fstack-protector' gives heuristic ssp, whereas
on gcc-3 it gives full ssp.


Upshot - managing ssp has become a bit of a pita :/ (gcc-4 is
currently masked in the hardened profile, primarily because gcc-4.0 has
no ssp, but going forward also until we decide what to do with the
hardened specs on gcc-4.1).

> there is also:
>
> -fno-stack-protector-to-all which if supplied makes
> -fno-stack-protector get promoted to -fno-stack-protector-all.
> Apparently -fno-stack-protector-to-all is on by default in all
> current gcc profiles so that means that at the moment if you specify
> -fno-stack-protector you really get -fno-stack-protector-all.

there is no '-fno-stack-protector-to-all' as such. the gcc specs we
change (in gcc-3) currently switch -fstack-protector-all on if
-fstack-protector is set (either on the command line or automatically
in the case of the hardened compiler). This occurs also with the
vanilla compiler - which is a bug although very few people
(if any) come across it as the only supported way to use the
stack protector at the moment is by using the hardened compiler.

-- 
Kevin F. Quinn