Description of problem:

python-config --cflags and python3-config --cflags contain irrelevant flags not necessary to compile against Python. For example:

% python-config --cflags
-I/usr/include/python2.7 -I/usr/include/python2.7 -fno-strict-aliasing -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -mcet -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv -DNDEBUG -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -mcet -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv

% python3-config --cflags 
-I/usr/include/python3.6m -I/usr/include/python3.6m  -Wno-unused-result -Wsign-compare -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -mcet -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv  -DDYNAMIC_ANNOTATIONS_ENABLED=1 -DNDEBUG -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -mcet -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv

In particular, the inclusion of -mcet and -fcf-protection make it impossible to compile Cython-using code with clang.

Version-Release number of selected component (if applicable):

Fedora 28 with

python2-Cython-0.28.1-1.fc28.x86_64
python3-Cython-0.28.1-1.fc28.x86_64

How reproducible:

Pretty easily. Use my branch rather than master since it has a patch to fix a comparator not being const invocable. 

Steps to Reproduce:
1. git clone -b wip-clangtasm https://github.com/adamemerson/ceph
2. cd ceph; sudo ./install-deps.sh
3. ./do_cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
4. cd build; make VERBOSE=1

Actual results:

cd /home/aemerson/ceph/src/pybind/rgw && env CC=" /usr/bin/clang" CXX=" /usr/bin/clang++" LDSHARED=" /usr/bin/clang -shared" OPT="-DNDEBUG -g -fwrapv -O2 -w" LDFLAGS=-L/home/aemerson/ceph/build/lib CYTHON_BUILD_DIR=/home/aemerson/ceph/build/src/pybind/rgw CEPH_LIBDIR=/home/aemerson/ceph/build/lib CFLAGS="-iquote/home/aemerson/ceph/src/include -w" /usr/bin/python2.7 /home/aemerson/ceph/src/pybind/rgw/setup.py build --verbose --build-base /home/aemerson/ceph/build/lib/cython_modules --build-platlib /home/aemerson/ceph/build/lib/cython_modules/lib.2
clang-6.0: error: unknown argument: '-mcet'
clang-6.0: error: unknown argument: '-fcf-protection'
clang-6.0: error: unknown argument: '-mcet'
clang-6.0: error: unknown argument: '-fcf-protection'

Expected results:

Cython code builds and doesn't have GCC only options injected into its compilation command.

Additional info:

Alternatively you could just say that NOT having -fcf-protection and -mcet in the output of python-config --cflags and pythong3-config --cflags is the expected behavior, since that's the proximate cause of compilation failure, and I'd be surprised if this didn't affect things other than Ceph.