[Bug 2078244] Re: ceph: Does not respect compiler flags for Python extensions

[Graham Inggs]

However, the change in that commit from:

set(cflags ${COMPILE_OPTIONS})

to:

set(PY_CFLAGS ${COMPILE_OPTIONS})

Doesn't seem a likely cause of the error.

Looking at the build of 16.2.9-0ubuntu0.21.10.1 in Impish:

[ 93%] Generating ../../../lib/cython_modules/lib.3/cephfs.cpython-39-x86_64-linux-gnu.so
cd /<<PKGBUILDDIR>>/src/pybind/cephfs && env CC="/usr/bin/cc -iquote/<<PKGBUILDDIR>>/src/include -w -D'void0=dead_function(void)' -D'__Pyx_check_single_interpreter(ARG)=ARG ## 0'" CXX="/usr/bin/c++" LDSHARED="/usr/bin/cc -shared" OPT="-DNDEBUG -g -fwrapv -O2 -w" LDFLAGS=-L/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/lib CYTHON_BUILD_DIR=/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/src/pybind/cephfs CEPH_LIBDIR=/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/lib /usr/bin/python3.9 /<<PKGBUILDDIR>>/src/pybind/cephfs/setup.py build --verbose --build-base /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/lib/cython_modules --build-platlib /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/lib/cython_modules/lib.3

We can see the hardening flags are already missing, even though it still
has the older Distutils.cmake.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to ceph in Ubuntu.
https://bugs.launchpad.net/bugs/2078244

Title:
   ceph: Does not respect compiler flags for Python extensions

Status in ceph package in Ubuntu:
  Triaged
Status in ceph source package in Noble:
  Triaged
Status in ceph source package in Oracular:
  Triaged

Bug description:
  [Impact]
  The packaging does not respect compiler flags when building the Python extensions, notably hardening flags like the stack protector, as well as frame-pointer.

  [Test plan]
  Look at the build log and see that the build flags have been passed, notably stuff like

  -fno-strict-overflow -Wsign-compare -DNDEBUG -g -O2 -Wall -g -O2 -Werror=implicit-function-declaration -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=for
  mat-security -fcf-protection

  It can be seen that this is already the case for the shared libraries,
  it is only the Python extensions that are missing flags.

  [Where problems could occur]
  Hardening flags could surface existing (possibly security) bugs that have been asymptomatic so far; frame-pointers will incur some slow down.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/2078244/+subscriptions