52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
 
|
# OpenSSF Compiler Options Hardening Guide for C and C++
|
||
|
|
|
||
|
|
## Metadata
|
||
|
|
|
||
|
|
| Field | Value |
|
||
|
|
|---|---|
|
||
|
|
| Institute | Molodetz Institute — Research & Retrieval Division |
|
||
|
|
| Subject | safe-cpp-practices |
|
||
|
|
| Document type | Source Dossier |
|
||
|
|
| Tier | 1 |
|
||
|
|
| Source title | OpenSSF Compiler Options Hardening Guide for C and C++ |
|
||
|
|
| Source URL | https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html |
|
||
|
|
| Source publisher / author | Open Source Security Foundation (OpenSSF) Best Practices WG |
|
||
|
|
| Source type | standard |
|
||
|
|
| Source date (published) | Unknown — not stated (living document) |
|
||
|
|
| Date researched | 2026-10-27 |
|
||
|
|
| Researched by | tai (agent), model: Claude Opus 4.8, on behalf of retoor |
|
||
|
|
| Research method | web search synthesis |
|
||
|
|
| Confidence | High |
|
||
|
|
| Status | Active |
|
||
|
|
|
||
|
|
## Summary
|
||
|
|
|
||
|
|
The authoritative, vendor-neutral list of compiler and linker flags that harden a C/C++ binary in production. It pairs library precondition checks with stack and fortification protections and states the cost of each.
|
||
|
|
|
||
|
|
## Key findings
|
||
|
|
|
||
|
|
- Recommended production set pairs `_GLIBCXX_ASSERTIONS` with `_FORTIFY_SOURCE=3`, `-fstack-protector-strong`, and `-fstack-clash-protection`.
|
||
|
|
- `_GLIBCXX_ASSERTIONS` turns libstdc++ preconditions (container bounds, valid iterators) into checks; it has a small, roughly constant-time cost suitable for release.
|
||
|
|
- The full set also includes RELRO, noexecstack, PIE, and `-fstrict-flex-arrays=3`.
|
||
|
|
- The standard library's 'fast' hardening mode is security-critical constant-time checks meant to stay on in production; heavier fortification can cost performance.
|
||
|
|
- `-fstack-protector-strong` is called out as the balance point between coverage and cost.
|
||
|
|
- `_FORTIFY_SOURCE` is not general memory safety, and sanitizers can misbehave when combined with source fortification.
|
||
|
|
|
||
|
|
## Pros / strengths
|
||
|
|
|
||
|
|
Authoritative, concrete flag lists, honest about cost, separates cheap-always-on from expensive-test-only.
|
||
|
|
|
||
|
|
## Cons / limitations / caveats
|
||
|
|
|
||
|
|
A menu, not a policy: a project still must decide which flags gate release vs test. Says little about C++-level API design.
|
||
|
|
|
||
|
|
## Relevance to tai
|
||
|
|
|
||
|
|
Directly answers 'how do we make release builds catch the length_error/over-index class cheaply': _GLIBCXX_ASSERTIONS plus fortification. detz adopts the cheap subset for release and the full sanitizer set for the test net.
|
||
|
|
|
||
|
|
## Changelog
|
||
|
|
|
||
|
|
| Date | Change |
|
||
|
|
|---|---|
|
||
|
|
| 2026-10-27 | Initial dossier created (web search synthesis). |
|