[PATCH v2 2/4] configure: Default --enable-stack-protector to strong

[Florian Weimer]

* Siddhesh Poyarekar:

> On 2023-07-17 11:45, Florian Weimer via Libc-alpha wrote:
>> * Siddhesh Poyarekar via Libc-alpha:
>> 
>>> On 2023-07-13 05:51, Florian Weimer wrote:
>>>> * Siddhesh Poyarekar via Libc-alpha:
>>>>
>>>>> All major distributions use this level of stack protector, so make it
>>>>> the default.
>>>>>
>>>>> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
>>>> I think if strong is the default (correct IMHO), it should be the
>>>> default for --enable-stack-protector, too.  I'm not sure if we need to
>>>> support legacy -fstack-protector at all, but we do, we'd need a separate
>>>> option argument.
>>>> I would expect some build-many-glibcs.py updates for this one, too.
>>>> But I think for this one, --disable-stack-protector actually works.
>>>
>>> There's also --enable-stack-protector=full, which enables
>>> -fstack-protector-full, which is why I kept it as --enable-* rather
>>> than flipping it to --disable.
>> Do you mean =all?
>
> Sorry, yes, I meant =all.
>
>>> If we want to drop everything except strong, then IMO it doesn't make
>>> sense to add an addition configure option to enable the options that
>>> we dropped; it kinda defeats the whole point of the exercise.  If we
>>> want to retain them, then how about
>>> --enable-stack-protector={strong,full,legacy,no} with the default as
>>> strong?
>> I don't think we really need anything but strong; -all is
>> occasionally
>> interesting for correctness checking, though.  With -strong we might
>> miss cases where we did not systematically exclude some code because of
>> ordering dependencies because the compilers we tested with removed the
>> instrumentation as part of optimization.
>> My main point was that --enable-stack-protector should enable the
>> default (-strong), otherwise it's confusing.
>
> OK, so  --enable-stack-protector={strong,all,no} with the default as
> strong, thus dropping -fstack-protector?

Or perhaps --enable-stack-protector=plain for the legacy
-fstack-protector setting.

Thanks,
Florian