1843501 - Increase FORTIFY_SOURCE from 2 to 3

Status: UNCONFIRMED

(Firefox Build System :: General, enhancement)

Description

[Joonas Niilola]

Steps to reproduce:

Modern compilers in their current releases support hardened FORTIFY_SOURCE=3 while Firefox's build system forces 2. Apparently just updating -D_FORTIFY_SOURCE=2 to -D_FORTIFY_SOURCE=3 works, but some people responsible of security side of things probably want to confirm the differences and caveats.

Actual results:

The FORTIFY_SOURCE in Firefox is outdated.

Expected results:

It should be updated to line with modern compilers capabilities.

Comment 1

[Joonas Niilola]

Downstream bug with more information:
https://bugs.gentoo.org/910071

Comment 2

[Daniel Veditz [:dveditz]]

https://archlinux.org/todo/prepare-packages-for-d_fortify_source3/

https://bugzilla.redhat.com/show_bug.cgi?id=2158232

Comment 3

[Frederik Braun [:freddy]]

Looks like Arch is building Firefox successfully with FORITFY_SOURCE=3.
Not sure if that tracks, due to bug 1418398 and https://searchfox.org/mozilla-central/rev/eadfec923e2b9c927ade8d0dd4f08a82da50a8a9/build/moz.configure/toolchain.configure#2383-2389.

But if we can confirm this working, it might be a cheap win.

Comment 4

[Joonas Niilola]

In Gentoo we too already do a sed to enable FORTIFY_SOURCE=3 on build/moz.configure/toolchain.configure when +hardened use flag is specified.

https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox-118.0.2.ebuild?id=673ff5ed9ae5da6c5fd58bf9c0b2fe2c138742a8#n930

So far no reports regarding this, so it's looking good.