There seems to be a consensus, that
-D_FORTIFY_SOURCE=2 -O1
is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report.
What I'm confused about is, that _FORTIFY_SOURCE=2
needs an optimizer flag, despite the fact, that - at least according to this bug report - it can have security implications.
I have too little understanding to understand the gravity of -O1
on the security.
Can someone please shed some light on why -O1
is problem (preferably also how this can be mitigated) or why this is not a problem? Also if it has both sides, what would be the factors to consider?