fortify hardening still overrides debug builds in many cases

[nh2]

This is in some way a continuation of #18995 GCC has unwanted flags.

Even though that one is marked as solved, I have over the last 2 years encountered many situations where silently -O2 -D_FORTIFY_SOURCE=2 is added to builds where I have explicitly requested that a debug build be done (which should result in -O0 / no -O flag being passed).

For example, right now on meson-based builds (on Darwin, but I believe on Linux too), if I set

mesonBuildType = "debug";

it does not have the desired effect unless I also add

hardeningDisable = [ "fortify" ];

because the fortify hardening adds -O2 -D_FORTIFY_SOURCE=2 no matter what.

The same happend to me in various C++ builds, and it's always a big drag in development time when you just can't get your -O0 debug builds working.

---

Reading the PR description of #28029, it says

user supplied -O flags should take precedence over the hardening flags

so I suspect that this isn't good enough, because most development builds don't add -O0 explicitly -- instead they add no -O flag at all, so even with the PR -O2 is still added.

I think we must do something about it because it's a total pain.

[jirkadanek]

As a more universal workaround, one might want to use the catch-all

hardeningDisable = [ "all" ];

for example when the build error is

cc1plus: error: -Wformat-security ignored without -Wformat [-Werror=format-security]

[stale]

Thank you for your contributions.

This has been automatically marked as stale because it has had no activity for 180 days.

If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.

Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the related code and @ mention them in a comment.
2. Ask on the NixOS Discourse.
3. Ask on the #nixos channel on irc.freenode.net.

[jiridanek]

still an issue, but not really important to me

[stale]

I marked this as stale due to inactivity. → More info

[nh2]

still important to me

[cstrahan]

@nh2 maybe we should implicitly disabled the fortify hardening if the build type is debug? That seems to be the most logical solution, IIUC.

[zarelit]

Just putting this here since it backlinks to the old issue. This behavior impacts people working with Go as well, I have to disable fortify to make delve debugger work in vscode. go-delve/delve#3085

I don't know the infrastructure good enough to decide if the "unable to run delve" should be another issue on its own

[coreyoconnor]

This also impact scala-native - can't seem to not have fortify hardening applied.