Hi Norbert, this sounds a sensible initiative to me.
Do you have more information to share? Areas of interest: * concrete numbers from the performance measurements, * number and names of packages that required fixing, * their upstream status. In principle I see two possible ways for introducing the new flags: a) Append them to `_hardening_cflags` if we consider them generic hardening options that should be set for every hardened build. b) Allow more fine-grained control by introducing an extra macro, similar to e.g. `_include_frame_pointers`. I'm not sure which is preferable here. Regarding `-ftrivial-auto-var-init=zero`: this is best done as a separate effort because its implications are somewhat more invasive from what I know. Thanks, Christoph On Friday, 14 August 2026 09:43:44 Central European Summer Time Manthey, Norbert via devel wrote: > Hi all, > > I would like to propose hardening Fedora artifacts by extending the default > compilation flags. In the past, using the flags would have prevented or > revealed CVEs or logic bugs. > > In Amazon Linux we have been looking into changing the default compiler > flags. Specifically, we looked at adding the below: > > -fno-strict-overflow > -fno-strict-aliasing > -fno-delete-null-pointer-checks > > For these flags, we did not see significant changes in performance tests. We > found a few packages where the additional flags caused build errors, and > submitted fixed to the respective packages. > > What's a good process to get the flags into the redhat-rpm-config package, > e.g. via a new macro that could be overriden by specific spec files in case > the flags should not be used? Is there more information I should provide? > Would there be another process for other flags, like > -ftrivial-auto-var-init=zero where there can be minor performance > consequences? > > Best, > Norbert
signature.asc
Description: This is a digitally signed message part.
-- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
