Re: [PATCH RFC] gcc-plugins: Handle GCC version mismatch for OOT modules

Kees Cook
2021-03-04T00:52:17Z

On Wed, Mar 03, 2021 at 11:57:33AM -0800, Linus Torvalds wrote:
> End result: gcc plugins are pure garbage, and you should shun them. If

I think that's pretty harsh, but okay, opinions are opinions. As Josh
says, people are interested in them for not-uncommon real-world uses:

- stackleak has data-lifetime wiping coverage that -ftrivial-auto-var-init=zero
for either Clang or GCC doesn't cover. There are no plans to provide
such coverage under Clang yet. It's arguable that stackleak's benefits
are smaller than it's maintenance burden compared to having
-ftrivial-auto-var-init=zero, but we can have that conversation when
we get there. :)

- structleak is likely to vanish as soon as GCC supports
-ftrivial-auto-var-init=zero. Clang's implementation is done and in
use by every Clang-built kernel I know of.

- latent_entropy is likely less useful since the jitter entropy was added,
but I've not seen anyone analyze it. No "upstream" GCC nor Clang support
is planned.

- arm32 per-task stack protector canary meaningfully reduces the risk of
stack content exposures vs stack frame overwrites, but neither GCC
nor Clang seem interested in implementing this "correctly" (as done
for arm64 on GCC -- Clang doesn't have this for arm64 yet). I want this
fixed for arm64 on Clang, and maybe arm32 can be done at the same time.

- randstruct is likely not used for distro kernels, but very much for
end users where security has a giant priority over performance.
There's no "upstream" GCC plan for this, and the Clang support has
stalled.

> you really believe you need compiler plugins, you should look at
> clang.

This is currently true only in 1 case (structleak), and only a few
"traditional" distros are building the kernel with Clang right now. I
don't disagree: doing this via LLVM IR would be much easier, but the
implementations for the other above features don't exist yet. I expect
this to change over time (I expect Clang's randstruct and GCC's
-ftrivial-auto-var-init=zero to likely be the next two things to
appear), but it's not the case right now.

--
Kees Cook