From a6997b0c4b0243fa7e5c110228a3128c9ffb8b39 Mon Sep 17 00:00:00 2001
From: Roman Tsisyk <roman@tsisyk.com>
Date: Sat, 23 Jan 2016 20:51:07 +0300
Subject: [PATCH] gh-1262: Allow to disable backtraces entirely

* Fix hardening if backtraces are off
* Ensure that all tests are passed with hardened flags
* RPM: add --with/--without backtrace option (default is --with)
* RPM: remove dependency on libbfd, libiberty, libz if --without backtrace
* RPM: enable stripping and debuginfo if --without backtrace

Backtraces are still enabled by default.

Hardened flags used by RedHat:

  -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
  -fstack-protector-strong --param=ssp-buffer-size=4
  -pie -fPIC
---
 cmake/compiler.cmake | 25 +++++++++++++++----------
 rpm/tarantool.spec   | 14 +++++++++++---
 src/main.cc          |  7 ++++---
 3 files changed, 30 insertions(+), 16 deletions(-)

diff --git a/cmake/compiler.cmake b/cmake/compiler.cmake
index d4950505f3..e0a44381a4 100644
--- a/cmake/compiler.cmake
+++ b/cmake/compiler.cmake
@@ -103,14 +103,24 @@ unset(CC_DEBUG_OPT)
 #
 # Set flags for all include files: those maintained by us and
 # coming from third parties.
-# We must set -fno-omit-frame-pointer here, since we rely
-# on frame pointer when getting a backtrace, and it must
-# be used consistently across all object files.
-# The same reasoning applies to -fno-stack-protector switch.
 # Since we began using luajit, which uses gcc stack unwind
 # internally, we also need to make sure all code is compiled
 # with unwind info.
 #
+
+add_compile_flags("C;CXX" "-fexceptions" "-funwind-tables")
+
+# We must set -fno-omit-frame-pointer here, since we rely
+# on frame pointer when getting a backtrace, and it must
+# be used consistently across all object files.
+# The same reasoning applies to -fno-stack-protector switch.
+
+if (ENABLE_BACKTRACE)
+    add_compile_flags("C;CXX"
+        "-fno-omit-frame-pointer"
+        "-fno-stack-protector")
+endif()
+
 # In C a global variable without a storage specifier (static/extern) and
 # without an initialiser is called a ’tentative definition’. The
 # language permits multiple tentative definitions in the single
@@ -129,12 +139,7 @@ unset(CC_DEBUG_OPT)
 # are platforms lacking proper support for common symbols (osx).
 #
 
-add_compile_flags("C;CXX"
-    "-fno-common"
-    "-fno-omit-frame-pointer"
-    "-fno-stack-protector"
-    "-fexceptions"
-    "-funwind-tables")
+add_compile_flags("C;CXX" "-fno-common")
 
 if (NOT CMAKE_BUILD_TYPE STREQUAL "Debug")
 # Remove VALGRIND code and assertions in *any* type of release build.
diff --git a/rpm/tarantool.spec b/rpm/tarantool.spec
index 18e02628a0..1c907dd496 100644
--- a/rpm/tarantool.spec
+++ b/rpm/tarantool.spec
@@ -9,9 +9,6 @@ BuildRequires: readline-devel
 BuildRequires: cmake >= 2.8
 BuildRequires: gcc >= 4.5
 BuildRequires: libyaml-devel
-# binutils and zlib are needed for stack traces in fiber.info()
-BuildRequires: binutils-devel
-BuildRequires: zlib-devel
 %if 0%{?fedora} > 0
 # pod2man is needed to build man pages
 BuildRequires: perl-podlators
@@ -31,6 +28,12 @@ Requires(preun): chkconfig
 Requires(preun): initscripts
 %endif
 
+%bcond_without backtrace # enabled by default
+
+%if %{with backtrace}
+# binutils and zlib are needed for stack traces in fiber.info()
+BuildRequires: binutils-devel
+BuildRequires: zlib-devel
 #
 # Disable stripping of /usr/bin/tarantool to allow the debug symbols
 # in runtime. Tarantool uses the debug symbols to display fiber's stack
@@ -40,6 +43,7 @@ Requires(preun): initscripts
 # -fPIE break backtraces
 # https://github.com/tarantool/tarantool/issues/1262
 %undefine _hardened_build
+%endif
 
 Name: tarantool
 # ${major}.${major}.${minor}.${patch}, e.g. 1.6.8.175
@@ -83,7 +87,11 @@ C and Lua/C modules.
          -DCMAKE_INSTALL_LOCALSTATEDIR:PATH=%{_localstatedir} \
          -DCMAKE_INSTALL_SYSCONFDIR:PATH=%{_sysconfdir} \
          -DENABLE_BUNDLED_LIBYAML:BOOL=OFF \
+%if %{with backtrace}
          -DENABLE_BACKTRACE:BOOL=ON \
+%else
+         -DENABLE_BACKTRACE:BOOL=OFF \
+%endif
 %if %{with systemd}
          -DWITH_SYSTEMD:BOOL=ON \
          -DSYSTEMD_UNIT_DIR:PATH=%{_unitdir} \
diff --git a/src/main.cc b/src/main.cc
index bc32b04b7d..d12d36f874 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -179,10 +179,11 @@ sig_fatal_cb(int signo)
 
 	fdprintf(fd, "Current time: %u\n", (unsigned) time(0));
 	fdprintf(fd,
-		 "Please file a bug at http://github.com/tarantool/tarantool/issues\n"
-		 "Attempting backtrace... Note: since the server has "
-		 "already crashed, \nthis may fail as well\n");
+		 "Please file a bug at http://github.com/tarantool/tarantool/issues\n");
+
 #ifdef ENABLE_BACKTRACE
+	fdprintf(fd, "Attempting backtrace... Note: since the server has "
+		 "already crashed, \nthis may fail as well\n");
 	print_backtrace();
 #endif
 end:
-- 
GitLab