Re: Extend default compiler settings to harden applications

On Fri, Aug 14, 2026, at 9:43 AM, Manthey, Norbert via devel wrote:
> Hi all,

Hi,

> I would like to propose hardening Fedora artifacts by extending the 
> default compilation flags. In the past, using the flags would have 
> prevented or revealed CVEs or logic bugs.
>
> In Amazon Linux we have been looking into changing the default compiler 
> flags. Specifically, we looked at adding the below:
>
>   -fno-strict-overflow
>   -fno-strict-aliasing
>   -fno-delete-null-pointer-checks
>
> For these flags, we did not see significant changes in performance 
> tests. We found a few packages where the additional flags caused build 
> errors, and submitted fixed to the respective packages.
>
> What's a good process to get the flags into the redhat-rpm-config 
> package, e.g. via a new macro that could be overriden by specific spec 
> files in case the flags should not be used? Is there more information I 
> should provide? Would there be another process for other flags, like 
> -ftrivial-auto-var-init=zero where there can be minor performance 
> consequences?

This would go through the change process (system-wide) [1]. You could
propose the change for Fedora 46.

Regards,

Simon

[1]: https://docs.fedoraproject.org/en-US/operations/changes_guide/
-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new