Bug 30920

Summary:	FORTIFY_SOURCE=3 should be enabled in default compiler flags for Mageia 10
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Base system maintainers <basesystem>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	jani.valimaa
Version:	Cauldron
Target Milestone:	Mageia 10
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	rpm-mageia-setup-2.67-1.mga9.src.rpm	CVE:
Status comment:

Description David Walser 2022-09-30 22:41:38 CEST

I noticed this in the RHEL 8.7 beta release notes:
"GCC 12 and later supports _FORTIFY_SOURCE level 3 (rhbz#2033684)"

And Pascal found this link, describing the benefits and implications:
https://developers.redhat.com/articles/2022/09/17/gccs-new-fortification-level

Our default fortify cflags are set in /usr/lib/rpm/mageia/macros in rpm-mageia-setup:
%_fortify_cflags -Wp,-D_FORTIFY_SOURCE=2

After Cauldron opens for Mageia 10 development, we should set the value to 3.

Comment 1 David Walser 2022-09-30 22:42:05 CEST

"Mageia 10" target not yet available in Bugzilla, but will set that when it is.

Thomas Backlund 2022-09-30 22:46:29 CEST

Target Milestone: --- => Mageia 10

Comment 2 Lewis Smith 2022-10-01 20:47:00 CEST

Hoping base system is the best place to lodge this, as Thomas has already commented it.

Assignee: bugsquad => basesystem

Comment 3 Mageia Robot 2024-04-10 19:34:31 CEST

commit fc851c8f574799c42ec7b5505a005bdbf575c47f
Author: Jani Välimaa <wally@...>
Date:   Wed Apr 10 20:33:06 2024 +0300

    macros: use -D_FORTIFY_SOURCE=3 by default (mga#30920)
---
 Commit Link:
   https://gitweb.mageia.org/software/rpm/rpm-setup/commit/?id=fc851c8f574799c42ec7b5505a005bdbf575c47f

Comment 4 Jani Välimaa 2024-04-11 21:21:12 CEST

Fixed with rpm-mageia-setup-2.78-1.mga10.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
CC: (none) => jani.valimaa