use -fstack-protector-strong when available

With gcc-4.9, a new -fstack-protector-strong flag is available that is
between -fstack-protector (pretty weak) and -fstack-protector-all (pretty
strong) that provides good trade-offs between overhead but still providing
good coverage.  Update the places in glibc that use ssp to use this flag
when it's available.

This also kills off the indirection of hardcoding the flag name in the
Makefiles and adding it based on a have-ssp boolean.  Instead, the build
always expands the $(stack-protector) variable to the best ssp setting.
This makes the build logic a bit simpler and allows people to easily set
to a diff flag like:
	make stack-protector=-fstack-protector-all

diff --git a/ChangeLog b/ChangeLog
index 007f6c9d7e554f9c8950cb768b25ed2ab0f2153c..cc2e93934ba676cbf601e8f5166e292df857e5c3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2015-10-19  Mike Frysinger  <vapier@gentoo.org>
+
+       * config.make.in (have-ssp): Delete.
+       (stack-protector): New variable.
+       * configure.ac: Delete libc_cv_ssp export.  Add libc_cv_ssp_strong
+       cache test for -fstack-protector-strong.  Export stack_protector to
+       the best ssp flag.
+       * configure: Regenerated.
+       * login/Makefile (pt_chown-cflags): Always add $(stack-protector).
+       * nscd/Makefile (CFLAGS-nscd): Likewise.
+       * resolv/Makefile (CFLAGS-libresolv): Likewise.
+
 2015-10-16  H.J. Lu  <hongjiu.lu@intel.com>
 
        [BZ #19122]

diff --git a/config.make.in b/config.make.in
index 7f561eb3333a2002fdacd09eb036f1f600edd462..a7919227385fac5c7f954433e3ad565fd32d58d6 100644 (file)
--- a/config.make.in
+++ b/config.make.in
@@ -56,7 +56,7 @@ old-glibc-headers = @old_glibc_headers@
 unwind-find-fde = @libc_cv_gcc_unwind_find_fde@
 have-forced-unwind = @libc_cv_forced_unwind@
 have-fpie = @libc_cv_fpie@
-have-ssp = @libc_cv_ssp@
+stack-protector = @stack_protector@
 have-selinux = @have_selinux@
 have-libaudit = @have_libaudit@
 have-libcap = @have_libcap@

diff --git a/configure b/configure
index 3285213cb7497c27ff06a9b1a5d6f4bc83f0e6f4..bd4cabdfe876a6f866de782f5c019f6f1c738c70 100755 (executable)
--- a/configure
+++ b/configure
@@ -621,7 +621,7 @@ LIBGD
 libc_cv_cc_loop_to_function
 libc_cv_cc_submachine
 libc_cv_cc_nofma
-libc_cv_ssp
+stack_protector
 fno_unit_at_a_time
 libc_cv_output_format
 libc_cv_hashstyle
@@ -6050,6 +6050,33 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_ssp" >&5
 $as_echo "$libc_cv_ssp" >&6; }
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for -fstack-protector-strong" >&5
+$as_echo_n "checking for -fstack-protector-strong... " >&6; }
+if ${libc_cv_ssp_strong+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS -Werror -fstack-protector-strong -xc /dev/null -S -o /dev/null'
+  { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; }; then :
+  libc_cv_ssp_strong=yes
+else
+  libc_cv_ssp_strong=no
+fi
+
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_ssp_strong" >&5
+$as_echo "$libc_cv_ssp_strong" >&6; }
+
+stack_protector=
+if test "$libc_cv_ssp_strong" = "yes"; then
+  stack_protector="-fstack-protector-strong"
+elif test "$libc_cv_ssp" = "yes"; then
+  stack_protector="-fstack-protector"
+fi
+
 
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether cc puts quotes around section names" >&5
 $as_echo_n "checking whether cc puts quotes around section names... " >&6; }

diff --git a/configure.ac b/configure.ac
index eba7a15f11dcd0cea8fc698ae48af01ea5aed53e..e6cab9c5bda601f711edcebd1fb1801b0181eeb7 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1503,7 +1503,20 @@ LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector],
                   [libc_cv_ssp=yes],
                   [libc_cv_ssp=no])
 ])
-AC_SUBST(libc_cv_ssp)
+
+AC_CACHE_CHECK(for -fstack-protector-strong, libc_cv_ssp_strong, [dnl
+LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector-strong],
+                  [libc_cv_ssp_strong=yes],
+                  [libc_cv_ssp_strong=no])
+])
+
+stack_protector=
+if test "$libc_cv_ssp_strong" = "yes"; then
+  stack_protector="-fstack-protector-strong"
+elif test "$libc_cv_ssp" = "yes"; then
+  stack_protector="-fstack-protector"
+fi
+AC_SUBST(stack_protector)
 
 AC_CACHE_CHECK(whether cc puts quotes around section names,
               libc_cv_have_section_quotes,

diff --git a/login/Makefile b/login/Makefile
index 0f4bb22557de73fa6b4f50b4f27918af7d0f0dfc..0634f87cf5c67e33ebd3f285d7f18cd2e246ddc7 100644 (file)
--- a/login/Makefile
+++ b/login/Makefile
@@ -58,9 +58,7 @@ CFLAGS-getpt.c = -fexceptions
 ifeq (yesyes,$(have-fpie)$(build-shared))
 pt_chown-cflags += $(pie-ccflag)
 endif
-ifeq (yes,$(have-ssp))
-pt_chown-cflags += -fstack-protector
-endif
+pt_chown-cflags += $(stack-protector)
 ifeq (yes,$(have-libcap))
 libcap = -lcap
 endif

diff --git a/nscd/Makefile b/nscd/Makefile
index ede941d1b2a252de8a2cadd79c952301b0d0db6b..e1a1aa92fc699aa132f7192da49f698a078e5910 100644 (file)
--- a/nscd/Makefile
+++ b/nscd/Makefile
@@ -84,9 +84,7 @@ CPPFLAGS-nscd += -D_FORTIFY_SOURCE=2
 ifeq (yesyes,$(have-fpie)$(build-shared))
 CFLAGS-nscd += $(pie-ccflag)
 endif
-ifeq (yes,$(have-ssp))
-CFLAGS-nscd += -fstack-protector
-endif
+CFLAGS-nscd += $(stack-protector)
 
 ifeq (yesyes,$(have-fpie)$(build-shared))
 LDFLAGS-nscd = -Wl,-z,now

diff --git a/resolv/Makefile b/resolv/Makefile
index 1dcb75f7c7eb05c5dfa6fc8d537e77051e3899fd..add74875c6cbbeba50541474ee40fb2a337de68c 100644 (file)
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -90,9 +90,7 @@ CPPFLAGS += -Dgethostbyname=res_gethostbyname \
            -Dgetnetbyname=res_getnetbyname \
            -Dgetnetbyaddr=res_getnetbyaddr
 
-ifeq (yes,$(have-ssp))
-CFLAGS-libresolv += -fstack-protector
-endif
+CFLAGS-libresolv += $(stack-protector)
 CFLAGS-res_hconf.c = -fexceptions
 
 # The BIND code elicits some harmless warnings.