2

This is my first StackExchange question ever, and if it is in the wrong place (UNIX and Linux vs. somewhere like Software Engineering?) please point me right!

A very long time ago, I built a system using the Hardened Linux From Scratch guide (http://linuxfromscratch.org/hlfs/view/development/). I am in the middle of building another system because there are some applications that I would like to run that are not supported by my old system, and I'm thinking that it would be far easier and a bit more interesting to build this system from the ground up. The problem is that the HLFS guide and patches have taken a back burner and the project has died.

I liked the fact that the project hardened the toolchain by adding specific flags such as -D_FORTIFY_SOURCE=2, -fPIE -pie, -fstack-protector-all, and --param=ssp-buffer-size=4 by default (http://linuxfromscratch.org/hlfs/view/development/chapter05/gcc-pass2.html).

Problem is that I cannot find any guidance or even a consistent answer if these features are still relevant in GCC near versions that I would like to use (7.2.0 or so) or how to enable them. Searches show that the Fedora project (https://fedoraproject.org/wiki/Security_Features?rd=Security/Features#Stack_Smash_Protection.2C_Buffer_Overflow_Detection.2C_and_Variable_Reordering) and Ubuntu (https://wiki.ubuntu.com/GccSsp) still have these options, or ones very close in form to them "enabled by default", but I can't seem to find documentation on how to do this to a system that is being built.

The only thing that I could think of was using something like "alias gcc='gcc --options_go_here'", but that seems to be self defeating if I ever have to turn an option off, or change between similar options like -fpic instead of -fPIC.

Any advice, guidance, or better search terms for building gcc?

Improve this question
2
  • gcc is actually a wrapper around various tools (preprocessor, linker, etc). There are *.spec files in the distribution, with them you can control, with which options should it call them. On my system, these are in /usr/lib/gcc/x86_64-linux-gnu/5/, anyways list the files of your gcc package and grep for .spec$. Commented Dec 19, 2017 at 3:19
  • OK, I am not sure how to answer my own questions, but I think this might be a start. So..... I ignored the LFS instructions and turned to, of all things, the GCC installation manual! Looks like the set of options I need to add to configure for my question are --enable-host-shared --enable-default-pie --enable-default-ssp ...and perhaps more reading of the instructions. I hope this helps someone out there. Commented Dec 24, 2017 at 4:34

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.