compiler-flags-distro's Introduction

Usage of enabled-by-default hardening-related compiler flags across Linux distributions

.	Alpine	Debian	Fedora	Gentoo	Gentoo Hardened	Ubuntu	OpenSUSE	ArchLinux	OpenBSD	Chimera Linux	Android	Google Chrome
`-D_FORTIFY_SOURCE=2`	yes	2011	2007	yes	superseded	2008	2005	2021	?	yes	2017	yes
`-D_FORTIFY_SOURCE=3`	no	no	2023	no	2022	2024	2023	not yet	?	2024	no	yes
`-D_GLIBCXX_ASSERTIONS`	2023	no	2018	no	2022	no	yes	2021	no	no	no	?
`-D_LIBCPP_HARDENING_MODE_HARDENED`/`-flibc++-hardening`	no	no	no	no	?	no	no	no	?	?	no	?
`-D_LIBCPP_ENABLE_HARDENED_MODE` (deprecated)	not yet¹	no	no	no	2023	no	no	no	?	?	no	yes
`-D_LIBCXX_ENABLE_ASSERTIONS` (llvm16)	no	no	no	no	superseded	no	no	no	?	yes	?	yes
`-Wformat -Wformat-security`/`-Wformat=2`	2023	2011	2013	2009	2009	2008	yes	2021	?	2023	2010	yes
`-Wl,-z,noexecstack`	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes
`-Wl,-z,relro`/`-Wl,-z,now`	yes	yes	2015	no	yes	2008	2006	2017	?	yes	2013	yes
`-fPIE`/`-fPIC`/…	2008	2011	2015	yes	yes	2016	2017	2017	yes	yes	2012	yes
`-fcf-protection`/`-mcet`²	no	2023	2018	no	2021	2019	yes	2021	2023	no	no	?
`-fsanitize=bounds`	no	no	no	no	no	no	no	no	no	no	2019, partial	no
`-fsanitize=cfi`²	no	no	no	no	no	no	no	no	no	partial	2018, partial	?
`-fsanitize=safe-stack`²	no	no	no	no	no	no	no	no	no	no	?	?
`-fsanitize=shadow-call-stack`²	no	no	no	no	no	no	no	no	no	no	2019, partial	?
`-fsanitize=signed-integer-overflow`/`-ftrapv`	no	no	no	no	no	no	no	no	no	yes	2018, partial	?
`-fsanitize=undefined`	no	no	no	no	no	no	no	no	?	no	?	?
`-fstack-clash-protection`	2023	yes	2018	no	2018	2019	2018	2021	?	yes	?	?
`-fstack-protector-strong`	yes	yes	yes	yes	yes	2014	2006	2014	yes	yes	2015	?
`-fstack-protector`	superseded	superseded	superseded	superseded	superseded	superseded	superseded	superseded	superseded	superseded	2009	?
`-ftrivial-auto-var-init=zero`	no	no	no	no	no	no	no	no	?	2023	2020	?
`-mbranch-protection=standard`/`-mbranch-target-enforce`	no	2023	2020	no	no	2023	no	no	2023	no	?	?
`-mshstk`	no	no	no	no	no	no	no	no	no	no	?	?
`-msign-return-address=[all/non-leaf]`	no	no	superseded	no	no	no	no	no	superseded	superseded	?	?

Note that:

some flags are incompatible between each other
some flags are more useful than others
some flags are superseding some others
some libc are incompatible with some flags
"partial" means "enabled in a lot of places, but not everywhere, with substantial caveats"
while Google Chrome isn't a distribution, given the size of its source code, it's close enough™ to warrant inclusion in the table.

Sources and resources:

As -D_LIBCPP_ENABLE_HARDENED_MODE only works for llvm18, which isn't in Alpine yet. It replaces -D_LIBCPP_ASSERT and -D_LIBCPP_ENABLE_ASSERTIONS. ↩
Not supported by musl libc ↩ ↩² ↩³ ↩⁴

compiler-flags-distro's People

Contributors

Stargazers

Watchers

compiler-flags-distro's Issues

Ubuntu's GCC and dpkg

In Debian, compiler flags are implemented to protect their archive though dpkg. They expressly avoid changing gcc defaults. References in this repo point to Debian's gcc configs, I'd check dpkg-buildflags.

Ubuntu inherits these dpkg flags. Flags from gcc and dpkg and are used to build the Ubuntu Archive.

GCC flags are required to build artifacts, like software users compile or snaps, or anything not the Ubuntu Archive. What is listed on https://wiki.ubuntu.com/ToolChain/CompilerFlags applies to GCC.

So, in a way, all dpkg compiler flags in Debian apply to Ubuntu and Ubuntu is additionally setting GCC hardening flags* (there are probably exceptions to this). I'm not sure how you want to track this, but I wanted to let you know.

Also, the Debian and Ubuntu archive recently received -mbranch-protection https://bugs.launchpad.net/ubuntu/+source/gcc-13/+bug/2040321 through dpkg. And Debian recently received -fcf-protection (which Ubuntu GCC acquired in 19.10) https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=8f5aca71c1435c9913d5562b8cae68b751dff663

not ideal title, missing or non-best-practice flags

Explain what c/c++ compilers the flags are compatible with (clang and gcc most likely). The title reads like the flags are general, whereas in C/C++ land there is no such thing for compiler flags.
-fsanitize=signed-integer-overflow -fsanitize-undefined-trap-on-error creates better code due to using the compiler_rt builtins xor cpu intrinsics, see https://gist.github.com/jrelo/f5c976fdc602688a0fd40288fde6d886
Please link best practice checks for known CVEs (ie clang-tidy) and/or other tools without noise or configuration effort.

Personal opinion:

-Wstring-conversion could be added, because implicit std::sting -> bool & conversions, especially during function calls, are outright evil and not covered by -Wall, -Werror, -Wpedantic etc

Nice link also covering msvc: https://airbus-seclab.github.io/c-compiler-security/

Recommend Projects