book icon indicating copy to clipboard operation
book copied to clipboard

Linux_Hardening.md: Fix _FORTIFY_SOURCE macro

Open disconnect3d opened this issue 3 years ago • 0 comments

This commit fixes the mistake in the _FORTIFY_SOURCE macro where it was not prefixed with underscore while it has to be (see e.g. https://github.com/search?q=repo%3Abminor%2Fglibc%20FORTIFY_SOURCE&type=code).

Additionally, to make this macro add extra security, one has to enable optimizations. So I added the -O2 optimization flag to ensure people do use it properly.

Overall, I would recommend using -D_FORTIFY_SOURCE=3 with -O2 or -O3 though it adds runtime overhead. (The fortify source level 3 was added recently and you can read more about it here: https://developers.redhat.com/blog/2021/04/16/broadening-compiler-checks-for-buffer-overflows-in-_fortify_source).

You can also see the result of the correct vs incorrect macro along with optimizations and no optimizations on this screenshot (source): image

disconnect3d avatar Dec 27 '22 17:12 disconnect3d