[PATCH 2/2] xfsprogs: even more debug whining

["Darrick J. Wong" <djwong@kernel.org>]

From: Darrick J. Wong <djwong@kernel.org>

Yeah these should be consolidated

Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 configure.ac            |    2 ++
 include/builddefs.in    |   48 +++++++++++++++++++++++++++++++++++++++++++++++
 m4/package_sanitizer.m4 |   14 ++++++++++++++
 3 files changed, 64 insertions(+)

diff --git a/configure.ac b/configure.ac
index a4e491895e020d..3628f53dbb4a96 100644
--- a/configure.ac
+++ b/configure.ac
@@ -38,6 +38,8 @@ fi
 AC_PROG_CXX
 # no C++ build tools yet
 
+AC_HAVE_X86_CFLAGS
+
 AC_ARG_ENABLE(shared,
 [  --enable-shared=[yes/no]  Enable use of shared libraries [default=yes]],,
 	enable_shared=yes)
diff --git a/include/builddefs.in b/include/builddefs.in
index 41076ddf389f82..81678113815330 100644
--- a/include/builddefs.in
+++ b/include/builddefs.in
@@ -94,6 +94,54 @@ WARNINGS += -Wno-dangling-pointer		# gcc 12.2 bug
 WARNINGS += -Wno-error=type-limits		# rtgroups patchset
 WARNINGS += -Wno-error=array-bounds		# rtgroups patchset
 
+# OpenSSF recommendations March 2025
+# https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
+#WARNINGS += -O2				# already set elsewhere
+#WARNINGS += -Wall
+WARNINGS += -Wformat
+WARNINGS += -Wformat=2
+WARNINGS += -Wno-format-nonliteral		# xfs_db and friends fail this everywhere
+#WARNINGS += -Wconversion
+WARNINGS += -Wimplicit-fallthrough
+WARNINGS += -Werror=format-security
+WARNINGS += -U_FORTIFY_SOURCE
+WARNINGS += -D_FORTIFY_SOURCE=2			# debian defaults to 2
+WARNINGS += -D_GLIBCXX_ASSERTIONS
+#WARNINGS += -fstrict-flex-arrays=3		# not in gcc 12?
+WARNINGS += -fstack-clash-protection
+WARNINGS += -fstack-protector-strong
+WARNINGS += -Wl,-z,nodlopen
+WARNINGS += -Wl,-z,noexecstack
+WARNINGS += -Wl,-z,relro
+WARNINGS += -Wl,-z,now
+WARNINGS += -Wl,--as-needed
+WARNINGS += -Wl,--no-copy-dt-needed-entries
+
+# OpenSSF gcc recommendations
+WARNINGS += -Wtrampolines
+
+# OpenSSF per-arch recommendations + extra assertions
+WARNINGS += @arch_cflags@ -D_LIBCXX_ENABLE_ASSERTIONS
+
+# OpenSSF for production code
+WARNINGS += -fno-delete-null-pointer-checks
+WARNINGS += -fno-strict-overflow
+#WARNINGS += -fno-strict-aliasing		# elsewhere
+#WARNINGS += -ftrivial-auto-var-init=zero	# elsewhere
+
+# OpenSSF for obsolete C constructs
+WARNINGS += -Werror=implicit
+WARNINGS += -Werror=incompatible-pointer-types
+WARNINGS += -Werror=int-conversion
+
+# OpenSSF for multithreaded code
+WARNINGS += -fexceptions
+
+# chainguard.dev recommendations
+WARNINGS += -fno-omit-frame-pointer
+WARNINGS += -mno-omit-leaf-frame-pointer
+#WARNINGS += -fhardened				# not on gcc 12
+
 # Comment out for release builds
 CFLAGS += $(WARNINGS)
 BUILD_CFLAGS += $(WARNINGS)
diff --git a/m4/package_sanitizer.m4 b/m4/package_sanitizer.m4
index 6488f7ebce2f50..c20e5156907ab2 100644
--- a/m4/package_sanitizer.m4
+++ b/m4/package_sanitizer.m4
@@ -71,3 +71,17 @@ AC_DEFUN([AC_HAVE_TRIVIAL_AUTO_VAR_INIT],
     CFLAGS="${OLD_CFLAGS}"
     AC_SUBST(autovar_init_cflags)
   ])
+
+# Add arch-specific gcc flags if they exist
+AC_DEFUN([AC_HAVE_X86_CFLAGS],
+  [ AC_MSG_CHECKING([if C compiler supports various x86 CFLAGS])
+    OLD_CFLAGS="$CFLAGS"
+    TEST_CFLAGS="-fcf-protection=full -mshstk"
+    CFLAGS="$CFLAGS $TEST_CFLAGS"
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
+        [AC_MSG_RESULT([yes])]
+        [arch_cflags="$TEST_CFLAGS $arch_cflags"],
+        [AC_MSG_RESULT([no])])
+    CFLAGS="${OLD_CFLAGS}"
+    AC_SUBST(arch_cflags)
+  ])