[manjaro-dev] Fwd: [arch-dev-public] Changing compilation flags

[Tomasz Przybył]

Just FYI

Regards



--- Treść przekazanej wiadomości ---
Temat: 	[arch-dev-public] Changing compilation flags
Data: 	Mon, 24 Oct 2016 13:56:14 +1000
Nadawca: 	Allan McRae <allan at archlinux.org>
Odpowiedź-Do: 	Public mailing list for Arch Linux development
<arch-dev-public at archlinux.org>
Adresat: 	Public mailing list for Arch Linux development
<arch-dev-public at archlinux.org>



Hi all,

The results from the test-sec-flags [1] suite are in.  Many thanks to
those that wrote this and those that submitted results.  I'm not going
to list the summaries here, but the results show that at worst enabling
a bunch of security flags in our packages will have a <1% impact on
performance (and more likely a fraction of a percent).

That means we will add all of these to our default CFLAGS/LDFLAGS etc.
The changes are:

1) building gcc to enable PIE by default
2) add -z,now to LDFLAGS
3) and -fno-plt and -fstack-check to our CFLAGS

Adding PIE means that programs get loaded at a random address,
preventing an attacker from manipulating global data or hijacking
control by reusing code.  Without this, ASLR is ineffective.  Enabling
this by default in our compiler (there is a configure flag) means we
will need to rebuild all packages with static libraries (which should be
a fairly limited set).

Adding -z,now to LDFLAGS disables lazy loading.  This means all function
symbols are loaded at startup (with minor performance hit), but that
means our RELRO support will make everything ro instead of some of the
things.  Doing this enables us to use -fno-plt in our CFLAGS, which is a
run-time optimisation allowing faster use of libraries.

Adding -fstack-check to our CFLAGS guarantees stack overflows aren't
exploitable.

Note that any of these flags can be disabled in a PKGBUILD if really
needed...  But if that is the case, bug reports should be filed.


Given an assumed lack of objection, I will enable the build flags in our
pacman.conf and rebuild gcc to enable pie and put them in [staging] at
the end of this week (what better way to celebrate Halloween).  We will
need a new devtools release then too.  Then the packages with static
libraries will need rebuilt.

After that, I would like to see [core] completely rebuilt, and audited
to ensure our CFLAGS/LDFLAGS are actually being used in the build.

Cheers,
Allan


[1] https://www.archlinux.org/news/test-sec-flags-call-for-assistance/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.manjaro.org/pipermail/manjaro-dev/attachments/20161024/8974ba6d/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-dev/attachments/20161024/8974ba6d/attachment.pgp>