# How to enable GCC for gentoo -fstack-clash-protection to fix

## gentoo-find

https://www.openwall.com/lists/oss-security/2019/01/09/3

How to enable GCC for gentoo -fstack-clash-protection to fix systemd cve

----------

## Ant P.

Add it to your *FLAGS vars in make.conf and emerge -e @world.

----------

## gentoo-find

 *Ant P. wrote:*   

> Add it to your *FLAGS vars in make.conf and emerge -e @world.

 

COMMON_FLAGS="-fstack-clash-protection" ?

----------

## fedeliallalinea

 *gentoo-find wrote:*   

>  *Ant P. wrote:*   Add it to your *FLAGS vars in make.conf and emerge -e @world. 
> 
> COMMON_FLAGS="-fstack-clash-protection" ?

 

I think Ant P. means 

```
CFLAGS="<your current cflags> -fstack-clash-protection"

CXXFLAGS="${CFLAGS}"
```

----------

## Hu

Also, be sure you use a gcc that understands that option.  It appears to be new in 8.x.  If you use it in an older version, gcc will reject it and the build will fail.

```
$ gcc-7.3.0 -x c -o /dev/null /dev/null -c -fstack-clash-protection

gcc-7.3.0: error: unrecognized command line option '-fstack-clash-protection'; did you mean '-fstack-protector'?

$ gcc-8.2.0 -x c -o /dev/null /dev/null -c -fstack-clash-protection

$ 
```

----------

## fedeliallalinea

 *Hu wrote:*   

> Also, be sure you use a gcc that understands that option.  It appears to be new in 8.x.  If you use it in an older version, gcc will reject it and the build will fail.]

 

Thanks for the tips Hu, I missed this one.

----------

## kurly

 *fedeliallalinea wrote:*   

>  *Hu wrote:*   Also, be sure you use a gcc that understands that option.  It appears to be new in 8.x.  If you use it in an older version, gcc will reject it and the build will fail.] 
> 
> Thanks for the tips Hu, I missed this one.

 

Should be on already?

```
kurly@smile ~ $ LANG=C gcc-8.2.0 -Q --help=common | fgrep stack-clash

  -fstack-clash-protection          [enabled]
```

----------

## Tom_

I wonder if any of you has already enabled this flag globally. Does this flag cause compilation issue ?

----------

## Ant P.

 *Tom_ wrote:*   

> I wonder if any of you has already enabled this flag globally. Does this flag cause compilation issue ?

 

Evidently not, if you'd read the post directly above yours you'll see we already all have it enabled.

----------

## Tom_

Of course I read the post above but I didn't understand it at first. I thought that this command showed gcc capabilities (to show that gcc-8 was required for this flag) but not actual compiler flags. Sorry

----------

## Moonboots

https://bugs.gentoo.org/675050

----------

