From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp12.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id yD88B5fcQmLJYgAAgWs5BA (envelope-from ) for ; Tue, 29 Mar 2022 12:16:55 +0200 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp12.migadu.com with LMTPS id qEpUBJfcQmLUPwEAauVa8A (envelope-from ) for ; Tue, 29 Mar 2022 12:16:55 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id DAE782DA3C for ; Tue, 29 Mar 2022 12:16:54 +0200 (CEST) Received: from localhost ([::1]:40998 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nZ8uD-0002Fk-UC for larch@yhetil.org; Tue, 29 Mar 2022 06:16:53 -0400 Received: from eggs.gnu.org ([209.51.188.92]:41834) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nZ8t5-0002FW-7O for guix-devel@gnu.org; Tue, 29 Mar 2022 06:15:45 -0400 Received: from [2001:470:142:3::e] (port=32928 helo=fencepost.gnu.org) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nZ8t4-0006DO-3u; Tue, 29 Mar 2022 06:15:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=mQ8LwVqzT7JCGdeyeR7L05LrVVdSrmATw2Erdoj7j6g=; b=mGIKQZzgcIlv8qXjwCJc FGOhtWGS2OV4i+fz9ZAKx7qWQXL8273UkhWHvP4uW38eHV0RAAOHmrz6bxyXFvmyRG1/w/Yrt1nfW TASITfgP/RuQVnC/7GiT8Ks9RdMuet1+U1rM+VQiG7pCXi1gpmQNgfNI48vcYo9gU7ZwLFw8tQ5x9 217lXHNyEn56KY3GXUUoPp4zM5LxpnazVSUnsEBpaAV4e7rrqZzFCe6cCJaaKuv2LLZuK2M7xPz50 i/a8I3hT3VNbdIlEXeyctxPhRS4TwzOaUbyDQH0UrgRfxoTp8rKExuJUi7yI+qToridDYRssUxbrt sWPWlzQ15Db7pQ==; Received: from [193.50.110.177] (port=51524 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nZ8t0-0008Lo-Rl; Tue, 29 Mar 2022 06:15:40 -0400 From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Maxim Cournoyer Subject: Re: Hardened toolchain References: <874k3r8m4m.fsf@gmail.com> <8464b1bff3acb0a84f46ea6dcbbeaa7045b03d1c.camel@telenet.be> <874k3iwysf.fsf@gmail.com> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 9 Germinal an 230 de la =?utf-8?Q?R=C3=A9volution?= X-PGP-Key-ID: 0x090B11993D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-pc-linux-gnu Date: Tue, 29 Mar 2022 12:15:36 +0200 In-Reply-To: <874k3iwysf.fsf@gmail.com> (Maxim Cournoyer's message of "Sun, 27 Mar 2022 23:17:52 -0400") Message-ID: <87pmm512uv.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org, kiasoc5@tutanota.com, zimoun Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN X-Migadu-To: larch@yhetil.org X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1648549014; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=mQ8LwVqzT7JCGdeyeR7L05LrVVdSrmATw2Erdoj7j6g=; b=kBtypwqxwNU3KzuOTIxbbPh7O//HGFX4YsUblLTzphBkzS7YHpoy03Xn6hynCVVlgxEATF njgEaz6FnH+EMfFZgq/Rv0Pq+rsFiPmMChhFnotXsf5Zn9wh5KaXTB/i291b2zvgaMXnhI kSeiD60JQNxRl4gmigSoh6qra9jh5Gbu/Ir2Xn+Ftgln6Rvhpkw9CO4okoZea88brn1RsB PUGU9eAJmElvSARqQ5bKG9U/b3IMy+0R0r3MfQ9h6027rR0vTWEqyLpjS9AHl5xfBgkMqC c/FMWZZ08rhWx18WIslqcpXhAzBpqtjAtq1ygOwbRxyVgmAcaVgh9jvLFMDUUw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1648549014; a=rsa-sha256; cv=none; b=Mq/6O+ezm6MioaS51CpY2sRFGKxWuwbZxnMP6eS6CHDSSkU9DRxL7VrOFdoCQ3XluO9KU6 +fYDGRXQCVvCf0SN5yzl17ACq4H8xUgbv8hLrKoA2hKriiOY0dcVt7f6tFXB6b0w+TBc2c iRiv6cxuJgR59zprp2nCYdTl4tZhczxkM9wigOG3l/y5J4QCbhb1Pn92bOFflvQD10uMZe sml5ts3LpDN6gfl1pqPE7uWmsgLf1RwGO7VuF4Q2dfoHjwncgECKUrl2K/hKjHbAdFwhPX TIiHdBRmIZcidj022IgiQLn59juuNc/s8k0d+UGGjT2pfXRvUfPJaz0CVii3jQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=gnu.org header.s=fencepost-gnu-org header.b=mGIKQZzg; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -3.77 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=gnu.org header.s=fencepost-gnu-org header.b=mGIKQZzg; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: DAE782DA3C X-Spam-Score: -3.77 X-Migadu-Scanner: scn0.migadu.com X-TUID: nWBbCc7SQNXb Hi, Maxim Cournoyer skribis: > Maxime Devos writes: > >> zimoun schreef op ma 21-03-2022 om 14:34 [+0100]: >>> > * gcc can be compiled with `--enable-default-ssp --enable-default- >>> > pie` >>> > to enforce ssp and pic >>>=20 >>> You wrote [1]: >>>=20 >>> --8<---------------cut here---------------start------------->8--- >>> (define-public gcc >>> =C2=A0 (package >>> =C2=A0=C2=A0=C2=A0 (inherit gcc) >>> =C2=A0=C2=A0=C2=A0 (arguments >>> =C2=A0=C2=A0=C2=A0=C2=A0 (substitute-keyword-arguments (package-argumen= ts gcc) >>> =C2=A0=C2=A0=C2=A0=C2=A0 ((#:configure-flags flags >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 `(append (list "--enable-default-s= sp" "--enable-default-pie") >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ,fla= gs))))))) >>> --8<---------------cut here---------------end--------------->8--- >> >> I think it would be a lot simpler to just add this to the 'standard' >> gcc configure flags, in (gnu packages gcc), given that probably the >> idea is to do this hardening for all packages? Needs a world-rebuild >> though. > > +1. The whole distribution can probably benefit from this hardening. That=E2=80=99s something worth trying in a branch off =E2=80=98core-updates= =E2=80=99. Stack smashing protection (SSP) may incur measurable run-time overhead though so enabling that one by default may be less consensual. There are other things that could be done in this area, often with no or little overhead, such as building with -D_FORTIFY_SOURCE. Doing that transparently (without changing build systems) is a bit of a challenge though. Ludo=E2=80=99.