cmd/go: add more options to security whitelist

[olt]

What version of Go are you using (go version)?

Go 1.10

What operating system and processor architecture are you using (go env)?

MacOS 10.13.2

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/olt/Library/Caches/go-build"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/olt/dev/go"
GORACE=""
GOROOT="/usr/local/Cellar/go/1.10/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.10/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/np/2fhk15fn5qq6fm4j9s3vt_6r0000gn/T/go-build391399925=/tmp/go-build -gno-record-gcc-switches -fno-common"

Debian Jessie 3.16.0-4-amd64

GOARCH="amd64"
GOBIN=""
GOCHAR="6"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/olt/go"
GORACE=""
GOROOT="/usr/lib/go"
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0"
CXX="g++"
CGO_ENABLED="1"

What did you do?

Build code cgo code which includes the evaluated output of

// #cgo CXXFLAGS: $(mapnik-config --cxxflags --includes --dep-includes | tr '\n' ' ')

The output of mapnik-config --cxxflags is as follows (for two different versions):

-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -g0 -ansi -Wall -pthread -O2 -fno-strict-aliasing -finline-functions -Wno-inline -Wno-parentheses -Wno-char-subscripts

and

-std=c++11 -stdlib=libc++ -DBOOST_EXCEPTION_DISABLE -fvisibility=hidden -fvisibility-inlines-hidden -Wall -ftemplate-depth-300 -Wsign-compare -Wshadow -O3

What did you see instead?

For the first version:

go build: xx/xx/xx: invalid flag in #cgo CXXFLAGS: -ansi
go build: xx/xx/xx: invalid flag in #cgo CXXFLAGS: -finline-functions

It works with the following env: CGO_CXXFLAGS_ALLOW='-ansi|-finline-functions'

For the second version:

go build: xx/xx/xx: invalid flag in #cgo CXXFLAGS: -stdlib=libc++
go build: xx/xx/xx: invalid flag in #cgo CXXFLAGS: -fvisibility=hidden
go build: xx/xx/xx: invalid flag in #cgo CXXFLAGS: -fvisibility-inlines-hidden
go build: xx/xx/xx: invalid flag in #cgo CXXFLAGS: -ftemplate-depth-300

CGO_CXXFLAGS_ALLOW='-stdlib=.*|-fvisibility=hidden|-fvisibility-inlines-hidden|-ftemplate-depth[=-]\d+

-stdlib is already included in master, but the other options are missing. Note that -ftemplate-depth-300 uses - instead of =.

[ianlancetaylor]

More options to add to the whitelists:

From #23904:

LDFLAGS: -Wl,-rpath=$ORIGIN/lib

From #23909:

LDFLAGS: -mwindows

From #23923:

CXXFLAGS: -ffat-lto-objects
CXXFLAGS: -fuse-linker-plugin

(Note that -fuse-linker-plugin is safe as long as -B is not used, and -B is never safe anyhow.)

From #23749:

LDFLAGS: -mmacosx-version-min=10.8

(We currently accept -mmacos-x for the compiler, but not the linker.)

[ianlancetaylor]

From #23749:

LDFLAGS: -O3

[ianlancetaylor]

From #23938:

CFLAGS: -w

[andlabs]

(You meant to say 23904 instead of 23094 there; in case that bug accidentally gets marked as fixed by this fix.)

[ianlancetaylor]

Thanks; I updated the comment.

[ianlancetaylor]

Reported on #23749:

LDFLAGS: -shared

[andlabs]

(Oops, missed it: likewise for 23090. Not sure what the right issue number there is.)

Seconding -mmacosx in the linker here; was just about to report that myself. I will point out that the macOS linker will complain if the values of this flag conflict for any object file; what does Go itself do?

[AlexRouSg]

-mwindows is from #23909