Based on the following quote from this upstream thread https://crbug.com/533294: > We do want -fstack-protector-strong enabled. Chrome OS has been using it for years, and it does provide real-world mitigations. Android will be globally using it soon (there is active work on removing the last few problems there). And the following patch from GrapheneOS's Vanadium: https://github.com/GrapheneOS/Vanadium/blob/main/patches/0003-switch-to-fstack-protector-strong.patch Including the above patch would provide proactive security improvement over the existing -fstack-protector setting. The reason this was not done upstream looks to be because of this: > The size difference for a stripped Chromium branded chrome binary is 107700176 -> 110489552. 2.7 MB / 2.6% increase. This seems insignificant relative to the security benefit. Reproducible: Always
(In reply to pmquinn5 from comment #0) > Based on the following quote from this upstream thread > https://crbug.com/533294: > > > We do want -fstack-protector-strong enabled. Chrome OS has been using it for years, and it does provide real-world mitigations. Android will be globally using it soon (there is active work on removing the last few problems there). > > And the following patch from GrapheneOS's Vanadium: > > https://github.com/GrapheneOS/Vanadium/blob/main/patches/0003-switch-to- > fstack-protector-strong.patch > > Including the above patch would provide proactive security improvement over > the existing -fstack-protector setting. > > The reason this was not done upstream looks to be because of this: > > > The size difference for a stripped Chromium branded chrome binary is 107700176 -> 110489552. 2.7 MB / 2.6% increase. > > This seems insignificant relative to the security benefit. > i agree with you. The next chromium will be built with this compiler flag. Thanks!
FEDORA-2023-5d1b8507b8 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-5d1b8507b8
FEDORA-2023-5d1b8507b8 has been pushed to the Fedora 39 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-5d1b8507b8` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-5d1b8507b8 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-a32ad3e643 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a32ad3e643
FEDORA-2023-5d1b8507b8 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-a32ad3e643 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-a32ad3e643` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-a32ad3e643 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-a32ad3e643 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.