# GCC -fhardened and Clang -fhardened: a production hardening bundle

## Metadata

| Field | Value |
|---|---|
| Institute | Molodetz Institute — Research & Retrieval Division |
| Subject | safe-cpp-practices |
| Document type | Source Dossier |
| Tier | 1 |
| Source title | GCC -fhardened and Clang -fhardened: a production hardening bundle |
| Source URL | https://github.com/llvm/llvm-project/issues/122687 |
| Source publisher / author | GCC; LLVM project (issue 122687) |
| Source type | repository |
| Source date (published) | Unknown — not stated |
| Date researched | 2026-10-27 |
| Researched by | tai (agent), model: Claude Opus 4.8, on behalf of retoor |
| Research method | web search synthesis |
| Confidence | Medium |
| Status | Active |

## Summary

GCC's -fhardened is a single flag that turns on a production hardening bundle, and Clang is adding the same. It bundles the OpenSSF-style set so projects do not hand-maintain the list.

## Key findings

- GCC -fhardened bundles _FORTIFY_SOURCE=3, _GLIBCXX_ASSERTIONS, -ftrivial-auto-var-init=zero, PIE, RELRO, -fstack-protector-strong, stack-clash protection.
- If glibc is older than 2.35 it falls back to _FORTIFY_SOURCE=2.
- The exact set may change between major GCC releases, so it is a moving (improving) target.
- Commentary: these protections are cheap enough that major Linux distributions already ship them by default.

## Pros / strengths

One flag, maintained by the toolchain, tracks evolving best practice.

## Cons / limitations / caveats

Set changes across releases (reproducibility caveat); a project's own configure can override pieces; not yet in all shipping Clang versions.

## Relevance to tai

A future simplification for detz's release build (replace the hand-listed hardening flags with -fhardened once the toolchain baseline supports it).

## Changelog

| Date | Change |
|---|---|
| 2026-10-27 | Initial dossier created (web search synthesis). |