Enable STACKPROTECTOR_STRONG in kernel w/ hardened profile?

jessetaylor84 · n00b Joined: 21 Sep 2014 Posts: 4 Location: Cascadia, USA

I'm currently installing Gentoo Hardened, and am configuring the kernel. It is my understanding that the hardened profile automatically passes -fstack-protector-all for all builds. In the kernel configuration, there is an option called Stack Protector buffer overflow detection (CC_STACKPROTECTOR) and I'm trying to determine whether I should set it to "none", "regular", or "strong" for use with the hardened profile?

kernelOfTruth · Posted: Sun Sep 21, 2014 10:59 pm Post subject:

try out "strong":

http://patchwork.linux-mips.org/patch/6235/

it's superior than fstack-protector-all

less performance hit
_________________
https://github.com/kernelOfTruth/ZFS-for-SystemRescueCD/tree/ZFS-for-SysRescCD-4.9.0
https://github.com/kernelOfTruth/pulseaudio-equalizer-ladspa

Hardcore Gentoo Linux user since 2004

N8Fear · Posted: Tue Sep 23, 2014 6:17 pm Post subject:

Note that fstack-protector-strong requires gcc-4.9.x or newer.

You should also note, that the kernel doesn't use the default CFLAGS. You define them indirectly though options like the one mentioned by you (i.e. you can't compile the kernel with -march=native, without patching it to be able to do so).