Switching on compiler/src options to harden FreeBSD

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)

--=_a2427b35e550a4fff54c825e74bcadb5
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII;
 format=flowed

Hi,

given the numerous talks at BSDCan about security in the last hours, and 
the mention of maybe enabling fortify by default, I want to point out
     
https://www.leidinger.net/blog/2025/05/24/freebsd-security-hardening-with-compiler-options/

I run a lot of this stuff on real workloads. Not in a high performance 
situation, more of a SOHO workload, but I have mysql, postgresql, redis, 
java application servers, python application servers, php, nginx, 
postfix, dovecot, squid, various dns servers (unbound, bind, 
adguardhome) and samba in >60 jails (some of them service jails, some of 
them normal jails, some of them service jails in normal jails). All of 
those build in a local poudirere with those options enabled.

This stuff works today, and we should maybe think about just enabling 
this stuff and go ahead. If it hinders a bit in the performance area, 
and it is important, it can be deactivated by those which need the last 
little bit of performance. In my situation where the CPUs are normally 
not near 100%, I can not feel a difference.

Just my 2 cents...

Bye,
Alexander.

-- 
http://www.Leidinger.net [email protected]: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    [email protected]  : PGP 0x8F31830F9F2772BF

--=_a2427b35e550a4fff54c825e74bcadb5
Content-Type: application/pgp-signature;
 name=signature.asc
Content-Disposition: attachment;
 filename=signature.asc;
 size=833
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEER9UlYXp1PSd08nWXEg2wmwP42IYFAmoy/FkACgkQEg2wmwP4
2IZQ6Q//TJX3OfjWAlr1lXASYHZukQkrxzLiOr0/hUXOrkuoAgTWI0UpMxZQD5tc
Cxy0w4JV7mK8nyya5KMXz3odAMzOkN73XXRAp2vVwDI1PzDTankhqld8MkPlUqeZ
zl/F9EczjPIfA2RP86OFAEp1Tg6C+veGmme41gWhcqC8KBJCAclMVhacjyT89hoV
J0RLfXEewjMYUkg5QNNH9FWOJpx55RehA9g8vrjMGSr83yr1uQsjD/BRPeG28m78
CCjTXheZ1tFuhMVXxmaO6KnWLzLWI0b9n66rSTdmhocVcjrS8Xk1j5KzzxIuzTrk
ifgD0KdPweUCT07iRpyyveCexov/x7oNnt67nv4l7WmlhHLLFcv6dUGXbVx4i9ug
p1ANkGvV2vOg8sUBVkMSDsLdmi+pDn4xoGxu9KxlTByn37lWMZtXtgMQv97sJ2q4
DOc1ypFtNsDID/P1BgNfceJJQSo7Kpqc1fxCA2O09ssU3Xy82ufn9K26uAUxpLAi
Gh3m0SbTSWzj5kpl1RnHvhaR6/+l2j7MKwCtaP06Ydb8KICsnAVtApiFpdiNQZEn
X9f3v7gL2+QmiPRrCOcS7Sbxyi/gMcEF5wrrpjHw/2GUIfdTnha0o2WklRKlc5nr
r215PWWWUlVibnJM490Nw1fSeVB1IIYQcGutTRxe65cCMf0xLBQ=
=f7c0
-----END PGP SIGNATURE-----

--=_a2427b35e550a4fff54c825e74bcadb5--