9489 2016-04-19 15:02:10 +0000 security_flags.inc has exception packages compiled without any -fstack-protector 2016-06-23 14:23:37 +0000 1 1 7 Build System, Metadata & Runtime Security - Recipe Upgrade security unspecified x86 Multiple RESOLVED FIXED Medium normal 2.2 1 elena.reshetova alex.kanavin alex.kanavin joshuagloe juro.bystricky richard.purdie --- --- No (bug/feature does not impact docs) oldest_to_newest 61412 0 elena.reshetova 2016-04-19 15:02:10 +0000 securirity_flags.inc has some packages that are not compiled with -fstack-protector-strong. Instead they should be tried to compile with CFLAGS +="-fstack-protector" to provide at least partial stack buffer overrun protection. 61419 1 alex.kanavin 2016-04-19 16:51:19 +0000 The difference between the two is that strong protector adds a stack guard to more functions than the regular protector does, but otherwise the protection technique is same. We can try, but I have a hunch that the failing packages will still fail. It's not a lot of packages by the way - grub, gcc, glibc, uclibc and valgrind. 61504 2 richard.purdie 2016-04-21 14:50:31 +0000 I also share the suspicion that they will fail but we could try it. I guess glibc is the main concern. 62924 3 alex.kanavin 2016-06-13 15:49:34 +0000 I checked all of those; the only ones where removing stack protection is no longer necessary are gcc-sanitizers and libgcc (in fact, they even work with full SECURITY_NO_PIE_CFLAGS now). I'll do a world build, then send a patch. 63280 4 alex.kanavin 2016-06-23 14:23:37 +0000 Patch is in master: 088120816835bfab2a675eb3f265b63290d077e6