GCC version number checks are broken, picking suboptimal -fstack-protector arg

[berrange]

Many of the makefiles have repeated the following check:

CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")

which is then used to select stack protection flags

ifeq ($(CC_BELOW_4_9), 1)
    COMMON_FLAGS += -fstack-protector
else
    COMMON_FLAGS += -fstack-protector-strong
endif

This expr command is broken when the GCC version is 10 or larger.

The presence of the '.' character in the expr comparison appears to make it perform a string comparison, instead of a numeric comparison. This only works as long as all parts of the version number are single digits. As soon as you have two digits it breaks.

As a result, with GCC >= 10, builds are getting weaker stack protection than expected - they're built with -fstack-protector instead of -fstack-protector-strong

Fortunately the NixOS build env for the enclaves only has GCC 9.5.0, so the AE builds have not been weakened, but anyone building non-enclave code on a modern Linux OS is using sub-optimal build args

[berrange]

NB, GCC 4.9.0 series was released way back in 2016. Rather than attempting to support a compiler that is over 9 years old, I'd suggest just deleting the version checks and assume -fstack-protector-strong always exists.

[berrange]

Proposed dropping the broken checks in #478

[bgotowal]

Thank you for reporting this!

There’s been some refactoring in the security flags area in 8814a5e, and many of the occurrences you mentioned here (and in #478) have already been adjusted as a by-product of changes along the lines you suggested. Let me double-check that we’ve covered all remaining cases, though.

Also, the current version is enabled for RHEL 10 / CentOS Stream 10.

[bgotowal]

Just reviewed #478. Although there've been similar changes merged in parallel in some files you've modified, there still seem to be places where we missed updates and you PR is worth getting back to if you're willing to update...

Thanks