Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1whP68-000CZu-0H for pgsql-hackers@arkaria.postgresql.org; Wed, 08 Jul 2026 10:01:44 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1whP65-006V4F-1I for pgsql-hackers@arkaria.postgresql.org; Wed, 08 Jul 2026 10:01:42 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1whP65-006V43-0K for pgsql-hackers@lists.postgresql.org; Wed, 08 Jul 2026 10:01:41 +0000 Received: from ma04-relay.lansolnet.com ([176.95.46.38]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1whP63-000000008MR-1J72 for pgsql-hackers@postgresql.org; Wed, 08 Jul 2026 10:01:40 +0000 ARC-Authentication-Results: i=1; ma04.lansolnet.com 1; spf=pass reason=mailfrom (ip=194.126.198.214, headerfrom=nidsa.net) smtp.mailfrom=nidsa.net smtp.helo=mail.cloud4partner.com; ARC-Message-Signature: a=rsa-sha256; bh=evefVJ4358nud4rJyg6eUy3SNv4rnMCMsrQ3dc0aRBM=; c=relaxed/relaxed; d=hornetsecurity.com; h=from:to:date:subject:mime-version:; i=1; s=hse1; t=1783504895; b=PLMK1OGkUyf+9Mv1f9HLZ8+lFGrVktL58jdTkroSuDO/KdGnVqvhnAH7ZaIjXmgeYB3ISs4z u4UEJbtWwwRQ2GwCqWG5VWiaskYEQjjQeC250x1Ugk3ZIQaAn+LKCXvcv6yfN/YPaHxakMF1EgS pWJL6GpAAAJRDLmiX1ljXyxmiCzy6hvpuxsrG61mncPv2BIYHW3RWGQ0udKJIGF4+SDyNZnf8xp 4eTw/YWaToUNAHR47InieSKVIfu0aiXnXWgzBQV/zNNiyO09rV0IQzRGX2WGKnqrJYFk3kuKE6g qdv1YwYR6+VIZInAXkFjyjd6FAwv24hhFheJ/Fbfcm2DQ== ARC-Seal: a=rsa-sha256; cv=none; d=hornetsecurity.com; i=1; s=hse1; t=1783504895; b=N4bXS+bElig1of1j2SYNJOG/OeS0dZv31AKgHGHRl7nFEauC3XIDBWNRViSmLW8xWSmL0VD8 uOS4jv1fx1wLQomjoghDhJbKTOV3rSuuQrGsx39uB/wnbk7MRV+VCc7WBfRKka5YuefezU9M4US SZ0a2wHCG+LOh9DKk8bEcqMwv7KoRd/h2oEQtk9sveY3EJOtstHu/dfx/nMhhy7IVWJqJDknYMY 0qs0/AWNQ+3v8i0uKubq3pYoMzECr0psDVxfhlUwQOsjp5mbnk1/5rw9HePdrlBNHqidn+02gWa Zx5JsvjbsqrmupLvjkcB4g4gZqPSr/Y38JDITSAG67s1g== Received: from unknown ([194.126.198.214]) by ma04; Wed, 08 Jul 2026 12:01:35 +0200 Received: from MBX200E.cloud4partner.com (192.168.8.234) by MBX200D.cloud4partner.com (192.168.8.233) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521) id 15.1.2507.44; Wed, 8 Jul 2026 12:01:32 +0200 Received: from MBX200E.cloud4partner.com ([fe80::e4a1:818c:c1f9:8e28]) by MBX200E.cloud4partner.com ([fe80::e4a1:818c:c1f9:8e28%15]) with mapi id 15.01.2507.044; Wed, 8 Jul 2026 12:01:32 +0200 From: Hans Buschmann To: Peter Eisentraut , "pgsql-hackers@postgresql.org" Subject: AW: Increased SECURITY RISCS from omitting some compikler options when building PG with meson; e.g. -fcf-protection=full Thread-Topic: Increased SECURITY RISCS from omitting some compikler options when building PG with meson; e.g. -fcf-protection=full Thread-Index: AQHdDgvEBR5VR+6/dkmCjQqZoZnn3rZjX8sO Date: Wed, 8 Jul 2026 10:01:32 +0000 Message-ID: <9412859e22d74f218562a535a7271a40@nidsa.net> References: <01e60576b689490a9388b3d840f23cd8@nidsa.net>, In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.168.8.240] Content-Type: multipart/alternative; boundary="_000_9412859e22d74f218562a535a7271a40nidsanet_" MIME-Version: 1.0 X-cloud-security-sender: buschmann@nidsa.net X-cloud-security-recipient: pgsql-hackers@postgresql.org X-cloud-security-Virusscan: CLEAN X-cloud-security-disclaimer: This E-Mail was scanned by E-Mailservice on ma04 with CA568B805F7 X-cloud-security-connect: unknown[194.126.198.214], TLS=1, IP=194.126.198.214 X-cloud-security: scantime:.5499 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --_000_9412859e22d74f218562a535a7271a40nidsanet_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello Peter Thanks for your quick response. I totally agree that it is impossible to always follow all distributions wi= th their specific compiler flags. But my intention was a bit different: asking for internal consistency. For distributions the PGDG publishes binaries for (see download page) a cer= tain selection of compiler flags are choosen. My intention is to set these flags as defaults for self-compiling on these = platforms. Most of the flags are compiler-driven, eventually changing with a new versi= on. I think it is important that these compiler options are DOCUMENTED (in the = binary distributions) so that they can be set or verified when self-compili= ng. I think the normal user cannot handle all these compiler options, it wants = to use the tested and provided standard managed by the developers. It is clear that the global benefits of some mitigations may arrive only mu= ch later (fedora 28 ->45). I think in the near future (APX and AVX10.2) there will be new architectura= l opportunities which really could target performance on newer architecture= s. This will require a more thoughtfull choice of compiler options.. Hans Buschmann --_000_9412859e22d74f218562a535a7271a40nidsanet_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable


Hello Peter

Thanks for your quick response.

I totally agree that it is impossible to always&nb= sp;follow all distributions with their specific compiler flags.

But my intention was a bit different: asking for i= nternal consistency.

For distributions the PGDG publishes binaries for = (see download page) a certain selection of compiler flags are choosen.

My intention is to set these flags as defaults for= self-compiling on these platforms.

Most of the flags are compiler-driven, eventually = changing with a new version.

I think it is important that these compiler option= s are DOCUMENTED (in the binary distributions) so that they can be set or v= erified when self-compiling.

I think the normal user cannot handle all these co= mpiler options, it wants to use the tested and provided standard managed by= the developers.

It is clear that the global benefits of some mitig= ations may arrive only much later (fedora 28 ->45).

I think in the near future (APX and AVX10.2) there= will be new architectural opportunities which really could target performa= nce on newer architectures. This will require a more thoughtfull choice of = compiler options..

Hans Buschmann

--_000_9412859e22d74f218562a535a7271a40nidsanet_--