Bug 9489 - security_flags.inc has exception packages compiled without any -fstack-protector
Summary: security_flags.inc has exception packages compiled without any -fstack-protector
Status: RESOLVED FIXED
Alias: None
Product: Security - Recipe Upgrade
Classification: Build System, Metadata & Runtime
Component: security (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium normal
Target Milestone: 2.2
Assignee: Alexander Kanavin
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2016-04-19 15:02 UTC by Elena Reshetova
Modified: 2016-06-23 14:23 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Elena Reshetova 2016-04-19 15:02:10 UTC 
securirity_flags.inc has some packages that are not compiled with -fstack-protector-strong. Instead they should be tried to compile with CFLAGS +="-fstack-protector" to provide at least partial stack buffer overrun protection.
Comment 1 Alexander Kanavin 2016-04-19 16:51:19 UTC 
The difference between the two is that strong protector adds a stack guard to more functions than the regular protector does, but otherwise the protection technique is same. We can try, but I have a hunch that the failing packages will still fail. 

It's not a lot of packages by the way - grub, gcc, glibc, uclibc and valgrind.
Comment 2 Richard Purdie 2016-04-21 14:50:31 UTC 
I also share the suspicion that they will fail but we could try it. I guess glibc is the main concern.
Comment 3 Alexander Kanavin 2016-06-13 15:49:34 UTC 
I checked all of those; the only ones where removing stack protection is no longer necessary are gcc-sanitizers and libgcc (in fact, they even work with full SECURITY_NO_PIE_CFLAGS now). I'll do a world build, then send a patch.
Comment 4 Alexander Kanavin 2016-06-23 14:23:37 UTC 
Patch is in master: 088120816835bfab2a675eb3f265b63290d077e6