Re: Extend default compiler settings to harden applications

Christoph Erhardt <[email protected]> Sun, 16 Aug 2026 16:28:20 +0200
Newsgroups	gmane.linux.redhat.fedora.devel
Message-ID	<[email protected]>
Hi Norbert,

this sounds a sensible initiative to me.

Do you have more information to share? Areas of interest:
* concrete numbers from the performance measurements,
* number and names of packages that required fixing,
* their upstream status.

In principle I see two possible ways for introducing the new flags:
a) Append them to `_hardening_cflags` if we consider them generic hardening 
options that should be set for every hardened build.
b) Allow more fine-grained control by introducing an extra macro, similar to 
e.g. `_include_frame_pointers`.

I'm not sure which is preferable here.

Regarding `-ftrivial-auto-var-init=zero`: this is best done as a separate 
effort because its implications are somewhat more invasive from what I know.

Thanks,
Christoph

On Friday, 14 August 2026 09:43:44 Central European Summer Time Manthey, 
Norbert via devel wrote:
> Hi all,
> 
> I would like to propose hardening Fedora artifacts by extending the default
> compilation flags. In the past, using the flags would have prevented or
> revealed CVEs or logic bugs.
> 
> In Amazon Linux we have been looking into changing the default compiler
> flags. Specifically, we looked at adding the below:
> 
>   -fno-strict-overflow
>   -fno-strict-aliasing
>   -fno-delete-null-pointer-checks
> 
> For these flags, we did not see significant changes in performance tests. We
> found a few packages where the additional flags caused build errors, and
> submitted fixed to the respective packages.
> 
> What's a good process to get the flags into the redhat-rpm-config package,
> e.g. via a new macro that could be overriden by specific spec files in case
> the flags should not be used? Is there more information I should provide?
> Would there be another process for other flags, like
> -ftrivial-auto-var-init=zero where there can be minor performance
> consequences?
> 
> Best,
> Norbert

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
signature.asc (application/pgp-signature, 833 B)