There seems to be a consensus, that
is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report.
What I'm confused about is, that
_FORTIFY_SOURCE=2 needs an optimizer flag, despite the fact, that - at least according to this bug report - it can have security implications.
I have too little understanding to understand the gravity of
-O1 on the security.
Can someone please shed some light on why
-O1 is problem (preferably also how this can be mitigated) or why this is not a problem? Also if it has both sides, what would be the factors to consider?