RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-14 Thread Baesken, Matthias
gt; > >> -Original Message- > >> From: Erik Joelsson > >> Sent: Freitag, 10. Mai 2019 16:29 > >> To: Baesken, Matthias ; David Holmes > >> ; 'build-dev@openjdk.java.net' >> d...@openjdk.java.net> > >> Subject: Re: RFR: 81

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-14 Thread Erik Joelsson
, Matthias ; David Holmes ; 'build-dev@openjdk.java.net' Subject: Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags Hello Matthias, I think just -U_FORTIFY_SOURCE should be enough to unset it, no need to also set it to

RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-14 Thread Baesken, Matthias
openjdk.java.net' d...@openjdk.java.net> > Subject: Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - > was : RE: gcc FORTIFY_SOURCE application security flags > > Hello Matthias, > > I think just -U_FORTIFY_SOURCE should be enough to unset it, no need to > also set

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-10 Thread Erik Joelsson
gt; 4.6 in jdk/jdk ) Best regards, Matthias -Original Message- From: Erik Joelsson Sent: Donnerstag, 9. Mai 2019 15:18 To: Baesken, Matthias ; David Holmes ; 'build-dev@openjdk.java.net' Subject: Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FOR

RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-09 Thread Baesken, Matthias
used gcc's we are always > 4.6 in jdk/jdk ) > > > > Best regards, Matthias > > > > > >> -Original Message- > >> From: Erik Joelsson > >> Sent: Donnerstag, 9. Mai 2019 15:18 > >> To: Baesken, Matthias ; David Holmes > &g

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-09 Thread Erik Joelsson
vid Holmes ; 'build-dev@openjdk.java.net' Subject: Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags Hello, I just tried this and you are correct. However, it does seem to work if you instead use -U_FORTIFY_SOURCE. /E

RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-09 Thread Baesken, Matthias
enjdk.java.net> > Subject: Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - > was : RE: gcc FORTIFY_SOURCE application security flags > > Hello, > > I just tried this and you are correct. However, it does seem to work if > you instead use -U_FORTIFY_SOURCE. &

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-09 Thread Erik Joelsson
Hello, I just tried this and you are correct. However, it does seem to work if you instead use -U_FORTIFY_SOURCE. /Erik On 2019-05-09 05:36, Baesken, Matthias wrote: Hi Erik, while setting -O and -O (with x != y ) in one gcc/g++ command line call works , setting together -D_FORT

RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-09 Thread Baesken, Matthias
Hi Erik, while setting -O and -O (with x != y ) in one gcc/g++ command line call works , setting together -D_FORTIFY_SOURCE=2 and -D_FORTIFY_SOURCE=0 in one command line call generates a warning , so I think we cannot do that . Best regards, Matthias > Hello Matthias, > > O

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-08 Thread sgehwolf
Hi Matthias, For some background about the -O2 -ffp-contract=off flags for sharedRuntimeTrig.cpp and sharedRuntimeTrans.cpp see: https://bugs.openjdk.java.net/browse/JDK-8210425 My understanding is that if there is a per-file override of the optimization level, the compilation command will end up

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-08 Thread Erik Joelsson
Hello Matthias, On 2019-05-08 06:27, Baesken, Matthias wrote: Hello,I looked a bit more into it . It seems to me , that when -ffp-contract=off is available which is the case with current gcc versions , we want to optimize the 2 special files ( sharedRuntimeTrig.cpp / sharedRunti

RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-08 Thread Baesken, Matthias
Hello,I looked a bit more into it . It seems to me , that when -ffp-contract=off is available which is the case with current gcc versions , we want to optimize the 2 special files ( sharedRuntimeTrig.cpp / sharedRuntimeTrans.cpp ). see the following comments : jdk/make/hotspot/li

RE: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-08 Thread Baesken, Matthias
lag . > > > > > > Best Regards, Matthias > > > > > > > >> -Original Message- > >> From: Baesken, Matthias > >> Sent: Dienstag, 7. Mai 2019 16:55 > >> To: 'Erik Joelsson' ; 'build- > >> d...@openj

Re: RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-08 Thread David Holmes
oelsson' ; 'build- d...@openjdk.java.net' Cc: 'Kim Barrett' ; Zeller, Arno Subject: RE: gcc FORTIFY_SOURCE application security flags Hello, I looked at JDK-8050803 . There are build issues reported when using the _FORTIFY_SOURCE flag . However I only noticed one build issue, th

RFR: 8130017: use _FORTIFY_SOURCE in gcc fastdebug builds - was : RE: gcc FORTIFY_SOURCE application security flags

2019-05-08 Thread Baesken, Matthias
// don't want to fail the test because of this. >FILE* pfile = posix::FOpen(premature_exit_filepath, "w"); > - fwrite("0", 1, 1, pfile); > + size_t cnt= fwrite("0", 1, 1, pfile); > + assert(cnt == (size_t)1); >fclose(pf

RE: gcc FORTIFY_SOURCE application security flags

2019-05-07 Thread Baesken, Matthias
st because of this. FILE* pfile = posix::FOpen(premature_exit_filepath, "w"); - fwrite("0", 1, 1, pfile); + size_t cnt= fwrite("0", 1, 1, pfile); + assert(cnt == (size_t)1); fclose(pfile); } } > -Original Message- > From: Erik Joe

Re: gcc FORTIFY_SOURCE application security flags

2019-05-06 Thread Florian Weimer
* Matthias Baesken: > I would prefer to get a hs_err file, do you know a way to get this in > context of the gcc flag _FORTIFY_SOURCE ? __fortify_fail should eventually raise SIGABRT. So if you install a handler for that signal, you should be able to generate hs_err file. __fortify_fail is diff

RE: gcc FORTIFY_SOURCE application security flags

2019-05-06 Thread Baesken, Matthias
gt;maybe some of you are aware of the gcc FORTIFY_SOURCE application > security flags. > > Developers can enable compile and also runtime checks for some string / > memory related operations with the flag. > > > > See details : > > https://access.redhat.com/blogs/766

Re: gcc FORTIFY_SOURCE application security flags

2019-05-03 Thread Kim Barrett
> On May 3, 2019, at 11:12 AM, Baesken, Matthias > wrote: > > > > > Hello. >maybe some of you are aware of the gcc FORTIFY_SOURCE application > security flags. > Developers can enable compile and also runtime checks for some string / > memory related o

Re: gcc FORTIFY_SOURCE application security flags

2019-05-03 Thread Erik Joelsson
Hello Matthias, We have tried to use it before but later removed it. See https://bugs.openjdk.java.net/browse/JDK-8050803 /Erik On 2019-05-03 08:12, Baesken, Matthias wrote: Hello. maybe some of you are aware of the gcc FORTIFY_SOURCE application security flags. Developers can

gcc FORTIFY_SOURCE application security flags

2019-05-03 Thread Baesken, Matthias
Hello. maybe some of you are aware of the gcc FORTIFY_SOURCE application security flags. Developers can enable compile and also runtime checks for some string / memory related operations with the flag. See details : https://access.redhat.com/blogs/766093/posts/1976213 Have you tried