[gentoo-dev] Re: Moving more hardening features to default?

[Ryan Hill]

On Thu, 20 Oct 2011 06:40:43 -0400
"Anthony G. Basile" <blueness@g.o> wrote:

> USE=hardened refers to only toolchain hardening.  The problems there are
> mostly packages which break with PIE because they (ab)use assembly.
> Things like virtualbox and some codecs.  This can become a thorny mess.
>
> It would probably be nearly painless to bring in -D_FORTIFY_SOURCES=2
> and ssp into mainstream though.  Packages which break because of either
> of those two features are broken and should be fixed anyhow.

If any of these features (other than -D_FORTIFY_SOURCE) relies on spec rule
handling of preprocessor flags then I'd like you to try reimplementing them
another way. I'm going to hack 4.6 to work properly but I expect it to break
again with 4.7.


-- 
fonts, gcc-porting,                  it makes no sense how it makes no sense
toolchain, wxwidgets                           but i'll take it free anytime
@ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662