From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46595C433F5 for ; Tue, 1 Feb 2022 09:09:14 +0000 (UTC) Subject: Re: Additional hardening options To: yocto@lists.yoctoproject.org From: "Robert Berger" X-Originating-Location: Athens, Attica, GR (85.75.26.181) X-Originating-Platform: Linux Chrome 97 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Tue, 01 Feb 2022 01:09:13 -0800 References: In-Reply-To: Message-ID: <10591.1643706553421712312@lists.yoctoproject.org> Content-Type: multipart/alternative; boundary="AjMD1Akhk5w8QZrdYQJ3" List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Feb 2022 09:09:14 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/56040 --AjMD1Akhk5w8QZrdYQJ3 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, This[1] is what I usually add as well to the security flags. With respect to the "default" flags I had some fun with the SDK and=C2=A0-D= _FORTIFY_SOURCE=3D2 and=C2=A0-fstack-protector-strong. I guess they do have some performance impact as well, but I did not do very= thorough research. Also, I did not confirm it yet but suspect that some of those flags might b= e the reason for "debuginfod gdb: *** stack smashing detected ***: terminat= ed".[2] [1] https://gitlab.com/meta-layers/meta-resy/-/blob/master/conf/distro/incl= ude/more_security_flags.inc [2] https://bugzilla.yoctoproject.org/show_bug.cgi?id=3D14570 Regards, Robert --AjMD1Akhk5w8QZrdYQJ3 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi,

This[1] is what I usually add as well to the security flags.=

With respect to the "default" flags I had some fun with the SDK= and -D_FORTIFY_SOURCE=3D2 and -fstack-protector-strong.
I guess they do have some performance impact as well, but I did not do v= ery thorough research.

Also, I did not confirm it yet but suspec= t that some of those flags might be the reason for "debuginfod gdb: *** sta= ck smashing detected ***: terminated".[2]

[1] https://gitlab.co= m/meta-layers/meta-resy/-/blob/master/conf/distro/include/more_security_fla= gs.inc

[2] https://bugzil= la.yoctoproject.org/show_bug.cgi?id=3D14570

Regards,
Robert --AjMD1Akhk5w8QZrdYQJ3--