-D/U_FORTIFY_SOURCE, -fstack-protector(-all) and --enable/disable-libssp

[Michael Zintakis]

I would appreciate some advice on using the above options during 1) 
building my cross-compilation toolchain; and 2) building my regular 
software.

My understanding is that for building the toolchain (gcc, glibc, 
binutils etc) it is advisable to disable FORTIFY_SOURCE and not use any 
ssp or -fstack-protector-* options.

Indeed, I was able to build my glibc library using just "-O2 
-U_FORTIFY_SOURCE" (my build failed - miserably so - when I used any of 
the above options), but I am not at all certain whether I did the right 
thing. From what I have read, I am better off disabling any form of ssp 
when building the toolchain. Is that right?

And then there is the issue with building the 'regular' software - 
should I enable or use these options (or can I, provided that I compiled 
my toolchain without them, assuming that I also used "--disable-libssp" 
as well?) and if so what of the above options should I use?

The software I need to build is a mixture of the kernel itself and 
regular programs, so I don't know whether to use the above options? Many 
thanks in advance for the advice given!