1

This is my first StackExchange question ever, and if it is in the wrong place (UNIX and Linux vs. somewhere like Software Engineering?) please point me right!

A very long time ago, I built a system using the Hardened Linux From Scratch guide (http://linuxfromscratch.org/hlfs/view/development/). I am in the middle of building another system because there are some applications that I would like to run that are not supported by my old system, and I'm thinking that it would be far easier and a bit more interesting to build this system from the ground up. The problem is that the HLFS guide and patches have taken a back burner and the project has died.

I liked the fact that the project hardened the toolchain by adding specific flags such as -D_FORTIFY_SOURCE=2, -fPIE -pie, -fstack-protector-all, and --param=ssp-buffer-size=4 by default (http://linuxfromscratch.org/hlfs/view/development/chapter05/gcc-pass2.html).

Problem is that I cannot find any guidance or even a consistent answer if these features are still relevant in GCC near versions that I would like to use (7.2.0 or so) or how to enable them. Searches show that the Fedora project (https://fedoraproject.org/wiki/Security_Features?rd=Security/Features#Stack_Smash_Protection.2C_Buffer_Overflow_Detection.2C_and_Variable_Reordering) and Ubuntu (https://wiki.ubuntu.com/GccSsp) still have these options, or ones very close in form to them "enabled by default", but I can't seem to find documentation on how to do this to a system that is being built.

The only thing that I could think of was using something like "alias gcc='gcc --options_go_here'", but that seems to be self defeating if I ever have to turn an option off, or change between similar options like -fpic instead of -fPIC.

Any advice, guidance, or better search terms for building gcc?

  • gcc is actually a wrapper around various tools (preprocessor, linker, etc). There are *.spec files in the distribution, with them you can control, with which options should it call them. On my system, these are in /usr/lib/gcc/x86_64-linux-gnu/5/, anyways list the files of your gcc package and grep for .spec$. – user259412 Dec 19 '17 at 3:19
  • OK, I am not sure how to answer my own questions, but I think this might be a start. So..... I ignored the LFS instructions and turned to, of all things, the GCC installation manual! Looks like the set of options I need to add to configure for my question are --enable-host-shared --enable-default-pie --enable-default-ssp ...and perhaps more reading of the instructions. I hope this helps someone out there. – user9105932 Dec 24 '17 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.