Re: [PATCH v2] Fix building error

[Julien Grall <julien.grall@linaro.org>]

Hi,

On 19/01/15 15:23, Ian Campbell wrote:
> On Thu, 2015-01-15 at 11:26 +0000, Ian Jackson wrote:
>> Wen Congyang writes ("[PATCH v2] Fix building error"):
>>>  ifeq ($(debug),y)
>>>  # Disable optimizations and enable debugging information for macros
>>>  CFLAGS += -O0 -g3
>>> +# _FORTIFY_SOURCE requires compiling with optimization
>>> +CFLAGS += -Wp,-U_FORTIFY_SOURCE
>>
>> I'm not entirely convinced about this.  I have two kinds of concern:
>>
>> One is practical, which is that ATM AIUI a debug build, while not
>> intended for production use, is not any less secure.  (Leaving aside
>> the ability of guests to perform a DoS with copious debugging output.)
>>
>> The other is that we seem to be entering into a battle of escalation
>> between various Makefiles.  Specifically, this seems to be a
>> workaround for a bug in some other Makefiles we are using: the bug
>> being that these other Makefiles can't cope with -O0.  And
>> unconditionally squashing the other Makefiles' options seems like a
>> big hammer.
>>
>> The fact that Fortify doesn't support -O0 is a property of Fortify
>> which ought to be encoded in Fortify (or the places where it is
>> enabled).
>>
>> Assuming that the underlying bug is intractible
> 
> I think so, see <54B73623.9040503@cn.fujitsu.com>. I suppose one could
> enter into a dialogue with Fedora about the practice of enabling these
> flags for all Python modules built on a Fedora system vs. just those
> built via RPM etc.

FWIW, I get the same error when building tools on OpenSuse.

I would find annoying to manually override the CFLAGS everytime I have
to build Xen.

Regards,

-- 
Julien Grall