Extend default compiler settings to harden applications

Hi all,

I would like to propose hardening Fedora artifacts by extending the default compilation flags. In the past, using the flags would have prevented or revealed CVEs or logic bugs.

In Amazon Linux we have been looking into changing the default compiler flags. Specifically, we looked at adding the below:

  -fno-strict-overflow
  -fno-strict-aliasing
  -fno-delete-null-pointer-checks

For these flags, we did not see significant changes in performance tests. We found a few packages where the additional flags caused build errors, and submitted fixed to the respective packages.

What's a good process to get the flags into the redhat-rpm-config package, e.g. via a new macro that could be overriden by specific spec files in case the flags should not be used? Is there more information I should provide? Would there be another process for other flags, like -ftrivial-auto-var-init=zero where there can be minor performance consequences?

Best,
Norbert

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new