Bug 2312869 - Consider using -fhardened for GCC [NEEDINFO]
Summary: Consider using -fhardened for GCC
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora
Classification: Fedora
Component: redhat-rpm-config
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Neal Gompa
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-09-17 15:49 UTC by Marek Polacek
Modified: 2026-06-10 18:54 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:
codonell: needinfo? (mpolacek)
fedora-admin-xmlrpc: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
GNU Compiler Collection 117967 0 P3 NEW -Wno-hardened does not disable all -fhardened warnings 2024-12-09 22:20:08 UTC

Description Marek Polacek 2024-09-17 15:49:23 UTC
GCC 14 introduced a new flag, -fhardened: Enable a set of flags for C and C++ that improve the security of the generated code without affecting its ABI.

Currently, -fhardened enables:

  -D_FORTIFY_SOURCE=3 (or =2 for older glibcs)
  -D_GLIBCXX_ASSERTIONS
  -ftrivial-auto-var-init=pattern
  -fPIE  -pie  -Wl,-z,relro,-z,now
  -fstack-protector-strong
  -fstack-clash-protection
  -fcf-protection=full (x86 GNU/Linux only)

We should consider using it in our distro for GCC.  See e.g. https://github.com/jvoisin/compiler-flags-distro/pull/7 for a nice brief discussion about this flag.

Comment 1 Neal Gompa 2024-09-18 18:44:28 UTC
As "-fhardened" is not granular like our current setup, it is probably not feasible for us to use it, as it would be complex to deal with wrt the existing macro knobs we have for manipulating all these flags.

Comment 2 Neal Gompa 2024-10-27 13:34:24 UTC
So after some discussion and such, I think this could be fine, however, I would like to see "-fhardened" to have comprehensive documentation about how it works in the GCC manual and how to disable portions of it when it breaks a build. If someone is going to do this, I will propose this as a Fedora Linux 42 Change.

Comment 3 Neal Gompa 2024-10-27 13:52:11 UTC
Another thought, it would be nice to consider making "-fhardened" tunable. For example, being able to "-fhardened=no-stack-protector,no-relro" would turn off stack protection and relro. That would make it much more appealing to replace a lot of our existing tunables with this.

Comment 4 Neal Gompa 2024-12-09 22:20:08 UTC
According to Carl Schwan, KDE has already started adopting this out of the box: https://invent.kde.org/frameworks/extra-cmake-modules/-/merge_requests/493

Nicolas Fella points out that there's still some goofiness around this: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117967

Comment 5 Aoife Moloney 2025-02-26 13:11:55 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 42 development cycle.
Changing version to 42.

Comment 6 Fedora Release Engineering 2026-05-06 11:53:55 UTC
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 42 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 7 Carlos O'Donell 2026-05-07 15:51:17 UTC
Can we define a mechanism that allows us to turn `-fhardened` on in redhat-rpm-config, but also provide a way to disable specific things that are a part of hardening? Note: That as upstream adds things to `-fhardened` we may need to add downstream knobs to turn this off.

In summary, three parts:
- Turn on the hardening by default, and document the option and what it does.
- Provide a rpm macro mechanism to disable specific narrow options that are part of the flags for packages that don't tolerate all options.
- Provide a future-proof mechanism to keep expanding that set of "disable" options as upstream gcc expands the meaning of `-fhardened`


Note You need to log in before you can comment on or make changes to this bug.