9948 2016-07-15 01:23:52 +0000 "-fstack-protector-strong" seems unnecessary in SECURITY_LDFLAGS 2017-02-07 13:29:43 +0000 1 1 7 Build System, Metadata & Runtime OE-Core configuration unspecified All Multiple RESOLVED WONTFIX Medium normal 2.3 1 hujiajie.org joshuagloe sgw --- --- Don't know oldest_to_newest 64016 0 hujiajie.org 2016-07-15 01:23:52 +0000 According to https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html, it seems that the "-fstack-protector-strong" flag is only needed for SECURITY_CFLAGS in meta/conf/distro/include/security_flags.inc, and there's no need to add it to SECURITY_LDFLAGS and SECURITY_X_LDFLAGS. 64931 1 joshuagloe 2016-08-05 13:40:20 +0000 Agreed, the docs state: "Emit extra code to check for buffer overflows, such as stack smashing attacks. This is done by adding a guard variable to functions with vulnerable objects." Emitting extra code is certainly a compiler, not linker, option. 65355 2 joshuagloe 2016-08-19 15:39:45 +0000 Patch sent to oe-core list: http://lists.openembedded.org/pipermail/openembedded-core/2016-August/125369.html 70487 3 joshuagloe 2017-02-07 13:29:43 +0000 There was some concern about dropping this and its presence doesn't appear to be causing issues. As we don't have a lot of bandwidth to fully test the ramifications of this on multiple toolchains and multiple layers I'm closing this as WONTFIX. If you believe there's an issue with continuing to include this option in SECURITY*LDFLAGS please reopen this bug and we'll try to find resources in a future cycle.