1044182 – Relax qemu-kvm stack protection to -fstack-protector-strong

Bug 1044182 - Relax qemu-kvm stack protection to -fstack-protector-strong

Summary: Relax qemu-kvm stack protection to -fstack-protector-strong

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	qemu-kvm
Sub Component:
Version:	7.0
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Miroslav Rezanina
QA Contact:	Virtualization Bugs
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2013-12-17 21:45 UTC by Karen Noel
Modified:	2014-06-18 03:44 UTC (History)
CC List:	10 users (show)
Fixed In Version:	qemu-kvm-1.5.3-47.el7
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2014-06-13 13:19:43 UTC
Target Upstream Version:

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Karen Noel 2013-12-17 21:45:16 UTC

Description of problem:

QEMU is using -fstack-protector-all which has worse performance (and little benefit) over -fstack-protector-strong.

From Steve Grubb:

> But in terms of overall protection, I think it would be better for all 
> libraries to be compiled with "strong" and qemu relaxed to "strong" rather 
> than qemu alone be compiled with "all" and libraries use the default 
> protector.
> 
> -Steve

Comment 5 Miroslav Rezanina 2014-02-12 12:00:09 UTC

Fix included in qemu-kvm-1.5.3-47.el7

Comment 7 Shaolong Hu 2014-02-24 06:49:51 UTC

Verified on qemu-kvm-1.5.3-49.el7:

[root@localhost qemu-kvm]# ./configure --target-list=x86_64-softmmu --disable-stack-protector > log
[root@localhost qemu-kvm]# ./configure --target-list=x86_64-softmmu --enable-stack-protector > log2
[root@localhost qemu-kvm]# diff log log2
16c16
< QEMU_CFLAGS       -Werror -fPIE -DPIE -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing  -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits   -I/usr/include/p11-kit-1     -I/usr/include/libpng15   -I/usr/include/spice-server -I/usr/include/cacard -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/pixman-1 -I/usr/include/nss3 -I/usr/include/nspr4 -I/usr/include/spice-1   -I/usr/include/nss3 -I/usr/include/nspr4   -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include   -I/usr/include/libusb-1.0     -I/usr/include/pixman-1   
---
> QEMU_CFLAGS       -Werror -fPIE -DPIE -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing  -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-strong   -I/usr/include/p11-kit-1     -I/usr/include/libpng15   -I/usr/include/spice-server -I/usr/include/cacard -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/pixman-1 -I/usr/include/nss3 -I/usr/include/nspr4 -I/usr/include/spice-1   -I/usr/include/nss3 -I/usr/include/nspr4   -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include   -I/usr/include/libusb-1.0     -I/usr/include/pixman-1

Comment 10 Ludek Smid 2014-06-13 13:19:43 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.