Re:GCC's new fortification level: The gains and costs
by siddhesh on Sunday September 18, 2022 @06:03PM
(#32891902)
OpenSUSE already enables it across the distribution; they were the first to do it. I believe Gentoo either already has or is in the process of doing it. I'll make a proposal for Fedora once I have a better idea of the code size and performance impact.
Re:GCC's new fortification level: The gains and costs
by thulle on Monday September 19, 2022 @04:42AM
(#32895822)
> I believe Gentoo either already has or is in the process of doing it.
There's a bug with the patch to enable it, tracking issues in other packages, so they seem to be in the process.
Re:GCC's new fortification level: The gains and costs
by pjmlp on Monday September 19, 2022 @02:26AM
(#32894956)
Android usually takes advantages of this kind of fortifiation levels (however the clang equivalents), SELinux is also enabled by default, syscalls are whitelisted on seccomp, hardware memory tagging is now done when available, and for poor folks like Termux, using anything not declared as public NDK API might kill the process.
I can imagine enabling this in programs that directly interact with the internet, e.g., web browsers, email clients, and resolver libraries. I can imagine Debian, Ubuntu, and Red Hat enabling it. It would especially make sense for Tails, at least in some cases. But that doesn't mean it will happen. I'd love to hear more.