[Discussion][Security] Compiler and linker flags

[samoht0]

Didn't find another discussion, so opening.

General CFLAGS/CXXFLAGS are for both branches (termux_step_setup_toolchain.sh)
"-g3 -O1 -fstack-protector --param ssp-buffer-size=4 -D_FORTIFY_SOURCE=2"

-D_FORTIFY_SOURCE=2 => GOOD
-fstack-protector => OK

But what about some more security enhancements?
-fstack-protector-strong
-fstack-clash-protection
-fcf-protection (only x86, so probably not very useful)
-D_GLIBCXX_ASSERTIONS

What about -O2 instead -O1?
It's well tested and considered working fine. Should work better with -D_FORTIFY_SOURCE=2 AFAIK.

General LDFLAGS are:
" -Wl,-rpath=$TERMUX_PREFIX/lib -Wl,--enable-new-dtags"

Is there an option for improved linker options in Termux (likely not, I guess)?
-Wl,-z,relro
-Wl,-z,now

https://wiki.debian.org/Hardening

[ghost]

1. -D_FORTIFY_SOURCE=2 causes build failures due to NDK headers. (for some packages)

2. -fstack-protector. From my experiments, it doesn't work at all or doesn't work properly. Again - due to NDK.

[ghost]

-D_GLIBCXX_ASSERTIONS

This is glibc-specific thing at all.

-O2 instead -O1

Btw, the line -g3 -O1 -fstack-protector --param ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 is for debug builds only.

[samoht0]

Btw, the line -g3 -O1 -fstack-protector --param ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 is for debug builds only.

OK, so there's just -Oz as default option for regular builds in CFLAGS/CXXFLAGS.
Well, FORTIFY_SOURCE and regular stack-protection failed tests. I see, there seems to be no suitable option here.

[ghost]

stack-protection failed tests

Stack protector doesn't cause build failures. It just don't work in same way as on PC.

[ghost]

It just don't work in same way as on PC.

Hmm, in NDK 20 it works....

So we can have:
C(XX)FLAGS: -Oz -fstack-protector-strong ...
LDFLAGS: -Wl,-rpath=$TERMUX_PREFIX/lib -Wl,--enable-new-dtags -Wl,-z,relro -Wl,-z,now...

Note that -Wl,-z,relro -Wl,-z,now is already used by some programs.

[samoht0]

So we can have:
C(XX)FLAGS: -Oz -fstack-protector-strong ...
LDFLAGS: -Wl,-rpath=$TERMUX_PREFIX/lib -Wl,--enable-new-dtags -Wl,-z,relro -Wl,-z,now...

Fine. Some security improvements. Looks for me like best practice, currently.

Relating -fstack-clash-protection I found out, that this isn't even supported in Clang.

Leaving this open for some time, to give contributes/users the chance to comment.

[ghost]

Done in e63524c.