Fedora Account System
Red Hat Associate
Red Hat Customer
GCC 14 introduced a new flag, -fhardened: Enable a set of flags for C and C++ that improve the security of the generated code without affecting its ABI. Currently, -fhardened enables: -D_FORTIFY_SOURCE=3 (or =2 for older glibcs) -D_GLIBCXX_ASSERTIONS -ftrivial-auto-var-init=pattern -fPIE -pie -Wl,-z,relro,-z,now -fstack-protector-strong -fstack-clash-protection -fcf-protection=full (x86 GNU/Linux only) We should consider using it in our distro for GCC. See e.g. https://github.com/jvoisin/compiler-flags-distro/pull/7 for a nice brief discussion about this flag.
As "-fhardened" is not granular like our current setup, it is probably not feasible for us to use it, as it would be complex to deal with wrt the existing macro knobs we have for manipulating all these flags.
So after some discussion and such, I think this could be fine, however, I would like to see "-fhardened" to have comprehensive documentation about how it works in the GCC manual and how to disable portions of it when it breaks a build. If someone is going to do this, I will propose this as a Fedora Linux 42 Change.
Another thought, it would be nice to consider making "-fhardened" tunable. For example, being able to "-fhardened=no-stack-protector,no-relro" would turn off stack protection and relro. That would make it much more appealing to replace a lot of our existing tunables with this.
According to Carl Schwan, KDE has already started adopting this out of the box: https://invent.kde.org/frameworks/extra-cmake-modules/-/merge_requests/493 Nicolas Fella points out that there's still some goofiness around this: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117967
This bug appears to have been reported against 'rawhide' during the Fedora Linux 42 development cycle. Changing version to 42.
This message is a reminder that Fedora Linux 42 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of '42'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, change the 'version' to a later Fedora Linux version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see it. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora Linux 42 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora Linux, you are encouraged to change the 'version' to a later version prior to this bug being closed.
Can we define a mechanism that allows us to turn `-fhardened` on in redhat-rpm-config, but also provide a way to disable specific things that are a part of hardening? Note: That as upstream adds things to `-fhardened` we may need to add downstream knobs to turn this off. In summary, three parts: - Turn on the hardening by default, and document the option and what it does. - Provide a rpm macro mechanism to disable specific narrow options that are part of the flags for packages that don't tolerate all options. - Provide a future-proof mechanism to keep expanding that set of "disable" options as upstream gcc expands the meaning of `-fhardened`