diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-05-22 14:45:52 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-05-22 14:45:52 +0000 |
| commit | 8deebce931fa9b469cf28a082038a64caf972602 (patch) | |
| tree | d7862c17e87d934dd333c0d3c56381cac5f29145 | |
| parent | 6ab30433a73b5e52a0562010b75257bcfc57bcbd (diff) | |
kernel: Enable -fstack-protector-strong by default
This extends stack canary use to all functions which define arrays on
the stack, not just those which operate on byte buffers. This option
would have made it harder to exploit SA-26:18.setcred and
SA-26:08.rpcsec_gss.
The change bloats the amd64 kernel text by about 350KB and increases the
number of covered functions from ~1500 to ~9000 (within the kernel
itself, i.e., not counting kernel modules).
Reviewed by: olce, olivier, emaste
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D56870
| -rw-r--r-- | sys/conf/kern.mk | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk index af7b1589c5cd..b87583db21c5 100644 --- a/sys/conf/kern.mk +++ b/sys/conf/kern.mk @@ -235,7 +235,7 @@ CFLAGS+= -fwrapv # Stack Smashing Protection (SSP) support # .if ${MK_SSP} != "no" -CFLAGS+= -fstack-protector +CFLAGS+= -fstack-protector-strong .endif # |