On Fri, Oct 22, 2021 at 02:22:22PM +0100, Richard W.M. Jones wrote:
I could use some help on this thread about Fedora hardening flags and getting them right for OCaml code:
I should have been more specific so people don't have to search the messages. Here are some questions:
(1) Should we add annotations to assembler (*.S) files?
(2) If (1), then what annotations precisely should we add and how?
(3) We're still seeing "gaps" in hardening on built binaries (but not in Fedora builds for some reason), how can we find out where they are?
(4) (Big ask) What do we need to do to enable cf-protection in the compiler?
Rich.