Changeset 5a95524

Timestamp:

01/30/2023 09:32:18 AM (15 months ago)

Author:

Xi Ruoyao <xry111@…>

Branches:

11.3, 12.0, 12.1, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, xry111/llvm18, xry111/xf86-video-removal

Children:

8d2373d8

Parents:

5cf5248

git-author:

Xi Ruoyao <xry111@…> (01/30/2023 09:30:14 AM)

git-committer:

Xi Ruoyao <xry111@…> (01/30/2023 09:32:18 AM)

Message:

building-notes: Update harderning section to match the status quo

By the way, use <option> to decorate the compiler options.

File:

• introduction/important/building-notes.xml (modified) (1 diff)

introduction/important/building-notes.xml

@@ -964 +964 @@
 
       <para>
+        In the past, there was Hardened LFS where gcc (a much older version)
+        was forced to use hardening (with options to turn some of it off on a
+        per-package basis).  The current LFS and BLFS books is carrying
+        forward a part of its spirit by enabling PIE
+        (<option>-fPIE -pie</option>) and SSP
+        (<option>-fstack-protector-strong</option>) as the defaults
+        for GCC and clang.  What is being covered here is different - first
+        you have to make sure that the package is indeed using your added
+        flags and not over-riding them.
+      </para>
+
+      <para>
         For hardening options which are reasonably cheap, there is some
         discussion in the 'tuning' link above (occasionally, one or more
         of these options might be inappropriate for a package). These
-        options are -D_FORTIFY_SOURCE=2, -fstack-protector=strong, and
-        (for C++) -D_GLIBCXX_ASSERTIONS. On modern machines these should
-        only have a little impact on how fast things run, and often they
-        will not be noticeable.
-      </para>
-
-      <para>
-        In the past, there was Hardened LFS where gcc (a much older version)
-        was forced to use hardening (with options to turn some of it off on a
-        per-package basis. What is being covered here is different - first you
-        have to make sure that the package is indeed using your added flags and
-        not over-riding them.
+        options are <option>-D_FORTIFY_SOURCE=2</option> and
+        (for C++) <option>-D_GLIBCXX_ASSERTIONS</option>. On modern
+        machines these should only have a little impact on how fast things
+        run, and often they will not be noticeable.
       </para>
 
       <para>
         The main distros use much more, such as RELRO (Relocation Read Only)
-        and perhaps -fstack-clash-protection. You may also encounter the
-        so-called 'userspace retpoline' (-mindirect-branch=thunk etc.) which
+        and perhaps <option>-fstack-clash-protection</option>. You may also
+        encounter the so-called <quote>userspace retpoline</quote>
+        (<option>-mindirect-branch=thunk</option> etc.) which
         is the equivalent of the spectre mitigations applied to the linux
         kernel in late 2018). The kernel mitigations caused a lot of complaints