Date: Wed, 17 Jun 2026 21:58:01 +0200 From: Alexander Leidinger <Alexander@Leidinger.net> To: FreeBSD Security list <freebsd-security@FreeBSD.org> Subject: Switching on compiler/src options to harden FreeBSD Message-ID: <0d41bfe199e62c951591a2d528b323b0@Leidinger.net>
index | next in thread | raw e-mail
[-- Attachment #1 --]
Hi,
given the numerous talks at BSDCan about security in the last hours, and
the mention of maybe enabling fortify by default, I want to point out
https://www.leidinger.net/blog/2025/05/24/freebsd-security-hardening-with-compiler-options/
I run a lot of this stuff on real workloads. Not in a high performance
situation, more of a SOHO workload, but I have mysql, postgresql, redis,
java application servers, python application servers, php, nginx,
postfix, dovecot, squid, various dns servers (unbound, bind,
adguardhome) and samba in >60 jails (some of them service jails, some of
them normal jails, some of them service jails in normal jails). All of
those build in a local poudirere with those options enabled.
This stuff works today, and we should maybe think about just enabling
this stuff and go ahead. If it hinders a bit in the performance area,
and it is important, it can be deactivated by those which need the last
little bit of performance. In my situation where the CPUs are normally
not near 100%, I can not feel a difference.
Just my 2 cents...
Bye,
Alexander.
--
http://www.Leidinger.net Alexander@Leidinger.net: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org netchild@FreeBSD.org : PGP 0x8F31830F9F2772BF
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEER9UlYXp1PSd08nWXEg2wmwP42IYFAmoy/FkACgkQEg2wmwP4
2IZQ6Q//TJX3OfjWAlr1lXASYHZukQkrxzLiOr0/hUXOrkuoAgTWI0UpMxZQD5tc
Cxy0w4JV7mK8nyya5KMXz3odAMzOkN73XXRAp2vVwDI1PzDTankhqld8MkPlUqeZ
zl/F9EczjPIfA2RP86OFAEp1Tg6C+veGmme41gWhcqC8KBJCAclMVhacjyT89hoV
J0RLfXEewjMYUkg5QNNH9FWOJpx55RehA9g8vrjMGSr83yr1uQsjD/BRPeG28m78
CCjTXheZ1tFuhMVXxmaO6KnWLzLWI0b9n66rSTdmhocVcjrS8Xk1j5KzzxIuzTrk
ifgD0KdPweUCT07iRpyyveCexov/x7oNnt67nv4l7WmlhHLLFcv6dUGXbVx4i9ug
p1ANkGvV2vOg8sUBVkMSDsLdmi+pDn4xoGxu9KxlTByn37lWMZtXtgMQv97sJ2q4
DOc1ypFtNsDID/P1BgNfceJJQSo7Kpqc1fxCA2O09ssU3Xy82ufn9K26uAUxpLAi
Gh3m0SbTSWzj5kpl1RnHvhaR6/+l2j7MKwCtaP06Ydb8KICsnAVtApiFpdiNQZEn
X9f3v7gL2+QmiPRrCOcS7Sbxyi/gMcEF5wrrpjHw/2GUIfdTnha0o2WklRKlc5nr
r215PWWWUlVibnJM490Nw1fSeVB1IIYQcGutTRxe65cCMf0xLBQ=
=f7c0
-----END PGP SIGNATURE-----
home |
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?0d41bfe199e62c951591a2d528b323b0>