Gentoo CFLAGS CXX FLAGS thread

>searched for gentoo >one post about some guys setup. Let's make one lainions. I'm Installing Gentoo in a couple of weeks and need some flags for my setup. Gentoo hardened, encrypted, grsecurity pax, mucl, libc , i3wm, gtk, latex, vim with python support for plugins. I'm planning on developing C, and using latex on it. I think it might be beneficial to me to start learning secure practices. I'm having a hard time thinking if I should use gcc or llvm or the default compiler.

>>377 Some packages fail with LLVM and it can cause other problems, I used LLVM Clang as the default compiler for a while. Trust me, set GCC as the default and use /etc/portage/package.env to optionally use Clang for specific packages such as large stuff that compiles faster with it. That's much safer and easier to do.

>>378 >Some packages fail Sadly, many people cannot write standard C. Good luck OP. FreeBSD is built with and ships with clang by default, so if you do decide on clang, try it out.

>>377 Your title doesn't match your OP body, but here is my best attempt at answering your questions. Regarding your title, See https://wiki.gentoo.org/wiki/Safe_CFLAGS and https://wiki.gentoo.org/wiki/GCC_optimization for serious advice on CFLAGS, and https://fun.irq.dk/funroll-loops.org/ and https://forums.gentoo.org/viewtopic-t-309752.html for meme advice. Regarding your post body see the following references https://wiki.gentoo.org/wiki/Handbook:Main_Page https://wiki.gentoo.org/wiki/Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened/FAQ https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart https://wiki.gentoo.org/wiki/Hardened/PaX_Quickstart https://wiki.gentoo.org/wiki/Project:Hardened_musl https://wiki.gentoo.org/wiki/Dm-crypt_full_disk_encryption https://wiki.gentoo.org/wiki/Dm-crypt http://gentoo-en.vfose.ru/wiki/DM-Crypt_with_LUKS https://wiki.gentoo.org/wiki/Project:Hardened_musl/Bluedragon (just install i3wm instead of the XFCE it ships with) As for use flags, are you asking for a list to set in /etc/portage/make.conf or are you looking for recommendations on package specific use flags as well (/etc/portage/package.use/) ? List of use flags can be found at https://www.gentoo.org/support/use-flags/ and https://github.com/gentoo/gentoo/blob/master/profiles/use.desc My recommendation isn't to make a giant list of use flags you want to use beforehand, but instead install packages and configure their use flags as you need them either manually with your text editor of choice or using ufed (https://wiki.gentoo.org/wiki/Ufed) interface. As well as searching for packages you want to install using https://packages.gentoo.org (for stuff in tree) and http://gpo.zugaina.org/ (for overlays and stuff you manage with layman), and looking at what local use flags they have. Based on the limited information you have provided some of the use flags you would be interested in using as a starting point include USE = "X crypt latex gtk vim-syntax threads python" Regarding whether LLVM will work as systemwide compiler in general (not on hardened) , see https://bugs.gentoo.org/show_bug.cgi?id=408963. As per >>378 , you will want gcc as default compiler and also have llvm installed. Regarding getting Clang sanitizers to work with PaX, see http://endl.ch/clang-sanitizers-with-pax . Also be aware that if you are using selinux you will want to identify your common usage patterns and have it warn you instead of blocking for a little while, and use that to make adjustments to the default policies. You will also need to be aware of the paxctl-ng and that certain programs will need certain PaX options (MPROTECT) disabled in order to run or when debugging with gdb ,etc. Good luck OP.

OP here This is still the CFLAGS & CXXFLAGS Gentoo thread. So post questions regarding so here so It doesn't flood the board. >>378 Thank you for your suggestion, I'll do exactly that. I'm still a noob when setting good practices for myself and I may just want to ease myself into the mindset. >>395 This is what I needed. I've looked at the gentoo handbbok, but the other links and your personal suggestions are what I needed. Thank you.

Gentoomen is still a thing. https://volafile.io/r/BEEPi

I got a question. Should I use grsecurity now that they are planning on being more restrictive with the licenses. What other security software is available other than selinux?

Clang can't compile itself without libgcc but it fails to compile a load of other stuff with libgcc so at the moment its not really usable as a full system compiler (also linux kernel can't be compiled with it). The gold linker works fine globally (again excluding the kernel at least with current stable binutils). As far as CFLAGS go I have CFLAGS="-march=haswell -O2 -pipe -flto -fno-fat-lto-objects -fuse-linker-plugin" and it works fine for most things, I just use package.env for the like 8 things that fail with LTO. musl is pretty neat and doesn't break too many things. Overall though I have begun moving to BSD as I feel that those projects have always been more organized and better built. Linux has turned into too much of a cluster fuarrrk. >>455 OpenBSD