What is the most hardened set of options for GCC compiling C/C++?

Question

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are there performance concerns or other issues that would prevent this GCC option from being on a mission critical application?

I am looking at the Debian Hardening Guide as well as GCC Mudflap. Here are the following configurations I am considering:

-D_FORTIFY_SOURCE=2
-fstack-protector --param ssp-buffer-size=4
-fPIE -pie
-Wl,-z,relro,-z,now (ld -z relro and ld -z now)

Are there any improvments that can be made to this set of options?

We are most worried about protecting WebKit form attacks.

Answer 1

I don't code for gcc, so hopefully someone else can add to this, or correct me. I'll edit it with responses. Some of these will not work for all circumstances.

• -Wall -Wextra -Wconversion ­-Wformat­security
  Turn on all warnings to help ensure the underlying code is secure.
• -Werror
  Turns all warnings into errors so you can't ignore them.
• -arch x86_64
  Compile for 64-bit to take max advantage of address space (important for ASLR).
• -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4
  Your choice of "-fstack-protector" does not protect all functions (weird huh). The warning flag here tells you of any functions that aren't going to get protected.
• -pie -fPIE
  For ASLR
• -ftrapv
  Generates traps for signed overflow
• -­D_FORTIFY_SOURCE=2 ­O2
  Buffer checks
• ­-Wl,-z,relro,-z,now
  Mark various ELF memory sections read­only (GOT protection)

If compiling on Windows, please Visual Studio instead of GCC, as some protections for Windows (ex. SEHOP) are not part of GCC, but if you must use GCC:

• -Wl,dynamicbase
  Tell linker to use ASLR protection
• -Wl,nxcompat
  Tell linker to use DEP protection

Answer 2

Those are good options, but you need to pay attention to your own source code. Make sure to use secure function when dealing with user inputs, filter them and when you use something like strncpy(), try not to give a lot of space to prevent certain attacks. OS itself provides security i.e. DEP (NX), ASLR and canaries to protect the stack, but you can't rely on them all the time. So, yeah, above is my suggestion. I hope that helps you a bit and you can also use source code auditing tools. Good luck!