commit: 469c078b8ada3bc00da386bd2eaa2dc3410e3323 Author: Sam James <sam <AT> gentoo <DOT> org> AuthorDate: Wed Dec 28 19:33:34 2022 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Sun Jan 1 21:16:42 2023 +0000 URL: https://gitweb.gentoo.org/data/gentoo-news.git/commit/?id=469c078b
2023-01-01-hardening-fortify-assertions: add item Bug: https://bugs.gentoo.org/876893 Bug: https://bugs.gentoo.org/876895 Signed-off-by: Sam James <sam <AT> gentoo.org> .../2023-01-01-hardening-fortify-assertions.en.txt | 57 ++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/2023-01-01-hardening-fortify-assertions/2023-01-01-hardening-fortify-assertions.en.txt b/2023-01-01-hardening-fortify-assertions/2023-01-01-hardening-fortify-assertions.en.txt new file mode 100644 index 0000000..dfe9127 --- /dev/null +++ b/2023-01-01-hardening-fortify-assertions/2023-01-01-hardening-fortify-assertions.en.txt @@ -0,0 +1,57 @@ +Title: Hardened profiles improvements +Author: Sam James <s...@gentoo.org> +Posted: 2023-01-01 +Revision: 1 +News-Item-Format: 2.0 +Display-If-Profile: features/hardened +Display-If-Profile: default/linux/ppc64le/17.0/musl/hardened +Display-If-Profile: default/linux/ppc/17.0/musl/hardened +Display-If-Profile: default/linux/amd64/17.0/no-multilib/hardened +Display-If-Profile: default/linux/amd64/17.0/hardened +Display-If-Profile: default/linux/amd64/17.0/musl/hardened +Display-If-Profile: default/linux/amd64/17.1/hardened +Display-If-Profile: default/linux/amd64/17.1/no-multilib/hardened +Display-If-Profile: default/linux/x86/17.0/hardened +Display-If-Profile: default/linux/arm/17.0/musl/armv7a/hardened +Display-If-Profile: default/linux/arm/17.0/musl/armv6j/hardened +Display-If-Profile: default/linux/arm/17.0/armv7a/hardened +Display-If-Profile: default/linux/arm/17.0/armv6j/hardened +Display-If-Profile: default/linux/ppc64/17.0/musl/hardened +Display-If-Profile: default/linux/arm64/17.0/hardened +Display-If-Profile: default/linux/arm64/17.0/musl/hardened + +Gentoo's hardened profiles are adopting two new modern toolchain hardening +techniques: +1. Level 3 fortification (-D_FORTIFY_SOURCE=3) [0] +2. libstdc++ assertions (-D_GLIBCXX_ASSERTIONS) [1] + +These will both be enabled by default with USE=hardened on sys-devel/gcc +for >=sys-devel/gcc-12.2.1_p20221224-r1. + +To view the existing list of hardening changes applied by the profiles, +see the wiki [2]. + +Stable users may wish to add sys-devel/gcc-12.2.1_p20221224-r1 into +/etc/portage/package.accept_keywords if they wish to take advantage +of these improvements early, before GCC 12 is marked stable. + +## Migration + +To fully take advantage of these new settings, GCC must first +be upgraded, and then all packages must be re-emerged: +1. emerge --sync +2. emerge --verbose --oneshot ">=sys-devel/gcc-12.2.1_p20221224-r1" +3. emerge --verbose --emptytree @world + +## Troubleshooting + +In the event that some packages fail at runtime, please file a bug +with the full details. To temporarily workaround the problem, +it should be possible to recompile broken packages with the +following *FLAGS: +CFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" +CXXFLAGS="${CXXFLAGS} -D_FORTIFY_SOURCE=2 -U_GLIBCXX_ASSERTIONS" + +[0] https://bugs.gentoo.org/876893 +[1] https://bugs.gentoo.org/876895 +[2] https://wiki.gentoo.org/wiki/Hardened/Toolchain#Changes
