Re: [PATCH] New configure option --with-elided-stack-protector-cflags

[Adhemerval Zanella <adhemerval.zanella@linaro.org>]

On 03/02/2021 14:45, Siddhesh Poyarekar wrote:
> On 2/3/21 11:11 PM, Adhemerval Zanella via Libc-alpha wrote:
>>
>>
>> On 03/02/2021 06:35, Siddhesh Poyarekar via Libc-alpha wrote:
>>> Add a new configure option --with-elided-stack-protector-cflags that
>>> allows customization of flags added to routines for whom the stack
>>> protector is elided due to them being called too early in program
>>> startup.  The default remains "-fno-stack-protector
>>> -DSTACK_PROTECTOR_LEVEL=0"
>>
>> Why exactly do you need to override the no_stack_protector default
>> value? I don't see why we can't just infer the required flags based
>> on the one used for stack protection.
> 
> In Fedora we use annobin to annotate objects with the flags they are built with.  For objects that are specifically built without stack protector, we would like to pass additional annobin related flags to make sure that the annotations are consistent.

Can't you deal with this specific requirement on annobin itself? I am not
seeing why the compiler plugin (if I understood correctly how the tool
works) can't add itself the required additional notes.

These kind of configuration should not really be required to be set and
exposing it is bleeding out an implementation details (that some objects
within glibc requires stack protection disabled).