mbox series

[v2,0/2] hardening: Enable i386 FORTIFY_SOURCE on Clang 16+

Message ID 20250308041950.it.402-kees@kernel.org (mailing list archive)
Headers show
Series hardening: Enable i386 FORTIFY_SOURCE on Clang 16+ | expand

Message

Kees Cook March 8, 2025, 4:29 a.m. UTC 
Hi,

This drops -ffreestanding for i386 unconditionally for GCC, and on
Clang version 16 and later. FORTIFY_SOURCE depends on the libcall
optimizations made without -ffreestanding on Clang. On GCC, there is no
expected differences. With that done, it's possible to gain Clang
FORTIFY_SOURCE coverage on i386 again, though only for Clang 16+.

-Kees


 v1: https://lore.kernel.org/lkml/20250303214929.work.499-kees@kernel.org/
 v2: drop -ffreestanding (Nathan)

Kees Cook (2):
  x86/build: Remove -ffreestanding on i386 with GCC
  hardening: Enable i386 FORTIFY_SOURCE on Clang 16+

 arch/x86/Makefile          | 2 ++
 security/Kconfig.hardening | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)