Description of problem: icecat has been rebuilt with all flags for "hardened build". /usr/lib64/icecat-%version/libmozalloc.so /usr/lib/icecat-%version/libmozalloc.so are without stack protection: # checksec --dir /usr/lib64/icecat-38.4.0 RELRO STACK CANARY NX PIE RPATH RUNPATH FILE Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/icecat Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/icecat-bin Full RELRO No canary found NX enabled DSO No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/libmozalloc.so Full RELRO Canary found NX enabled DSO No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/libxul.so Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/plugin-container Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/updater Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH /usr/lib64/icecat-38.4.0/webapprt-stub Expected results: All libraries should provide a 'Canary stack'.
What happens when it is compiled with --fstack-protector-all instead of --fstack-protector-strong? Do you get a canary?
(In reply to Moez Roy from comment #1) > What happens when it is compiled with --fstack-protector-all instead of > --fstack-protector-strong? Do you get a canary? '-fstack-protector-all' seems activate 'canary' in libmozalloc.so: https://koji.fedoraproject.org/koji/taskinfo?taskID=12130939
icecat-38.4.0-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-028d64a3ba
icecat-38.4.0-3.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-2277bad567
icecat-38.4.0-3.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update icecat' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-2277bad567
icecat-38.4.0-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update icecat' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-028d64a3ba
icecat-38.4.0-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
icecat-38.4.0-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.