Re: [PATCH 1/2] kbuild: remove cc-option test of -fno-stack-protector

[Nick Desaulniers]

On Fri, Jun 26, 2020 at 1:21 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> On Fri, Jun 26, 2020 at 01:13:20PM -0700, Nick Desaulniers wrote:
> > On Fri, Jun 26, 2020 at 12:00 PM Masahiro Yamada <masahiroy@xxxxxxxxxx> wrote:
> > >
> > > +++ b/Makefile
> > > @@ -762,7 +762,7 @@ ifneq ($(CONFIG_FRAME_WARN),0)
> > >  KBUILD_CFLAGS += -Wframe-larger-than=$(CONFIG_FRAME_WARN)
> > >  endif
> > >
> > > -stackp-flags-$(CONFIG_CC_HAS_STACKPROTECTOR_NONE) := -fno-stack-protector
> > > +stackp-flags-y                                    := -fno-stack-protector
> > >  stackp-flags-$(CONFIG_STACKPROTECTOR)             := -fstack-protector
> > >  stackp-flags-$(CONFIG_STACKPROTECTOR_STRONG)      := -fstack-protector-strong
> >
> > So it looks like the previous behavior always added
> > `-fno-stack-protector` (since CONFIG_CC_HAS_STACKPROTECTOR_NONE was
> > always true), but then we append either `-fstack-protector` or
> > `-fstack-protector-strong` based on configs.  While that's ok, and you
> > patch doesn't change that behavior, and it's good to be explicit to
> > set the stack protector or not...it seems weird to have
> > `-fno-stack-protector -fstack-protector` in the command line flags.  I
> > would prefer if we checked for not having CONFIG_STACKPROTECTOR or
> > CONFIG_STACKPROTECTOR_STRONG before adding `-fno-stack-protector`.
> > That doesn't have to be done in this patch, per se.
>
> No, it would add only what was latest and most selected. (They're all
> ":=" assignments.) If CONFIG_STACKPROTECTOR_STRONG, only
> -fstack-protector-strong is set. If only CONFIG_STACKPROTECTOR, only
> -fstack-protector is set. Otherwise -fno-stack-protector.

Ah, right. Thanks for pointing that out.  I'm still curious if the
CFLAGS_<file>.o rules get appended or overwrite all flags for that
translation unit?
-- 
Thanks,
~Nick Desaulniers