3

I'm trying to build a fairly hardened Gentoo install and I'd like to at least make sure that everything is built with -fstack-protector-strong if not -fstack-protector-all.

I'm on the hardened/linux/amd64/selinux profile, and here's my make.conf:

CFLAGS="-march=native -O2 -pipe"
CXXFLAGS="${CFLAGS}"
CHOST="x86_64-pc-linux-gnu"
USE="bindist mmx sse sse2 systemd -consolekit"
PORTDIR="/usr/portage"
DISTDIR="${PORTDIR}/distfiles"
PKGDIR="${PORTDIR}/packages"
ACCEPT_KEYWORDS="~amd64"

Does Hardened automatically set -fstack-protector-strong, or do I need to pass that to CFLAGS?

1 Answer 1

2

Yes, Gentoo Hardened uses fstack-protector-all by default, so you do not need to pass CFLAGS yourself to enable stack smashing protection. The default CFLAGS for the Hardened profile include:

CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,now -Wl,-z,relro"

See this section from the Gentoo Hardened FAQ for more info.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .