#1144478 blhc: bpf-gcc causes likely false positives

Package:
blhc
Source:
blhc
Submitter:
Witold Baryluk
Date:
2026-08-15 15:53:02 UTC
Severity:
normal
#1144478#5
Date:
2026-08-15 15:50:56 UTC
From:
To:
Dear Maintainer,


https://salsa.debian.org/baryluk-guest/network-manager/-/jobs/10140245


2426:CFLAGS missing (-g -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection): [443/1086] /usr/bin/bpf-gcc -std=gnu17 -Wunused -Wimplicit-fallthrough -fno-stack-protector -fno-ssa-phiopt -O2 -mcpu=v3 -mco-re -gbtf -c -D__x86_64__ -mlittle-endian -I. -isystem /usr/include/x86_64-linux-gnu -idirafter /usr/include ../src/core/bpf/clat.bpf.c -o src/core/bpf/clat.bpf.unstripped.o
2426:CPPFLAGS missing (-D_FORTIFY_SOURCE=2): [443/1086] /usr/bin/bpf-gcc -std=gnu17 -Wunused -Wimplicit-fallthrough -fno-stack-protector -fno-ssa-phiopt -O2 -mcpu=v3 -mco-re -gbtf -c -D__x86_64__ -mlittle-endian -I. -isystem /usr/include/x86_64-linux-gnu -idirafter /usr/include ../src/core/bpf/clat.bpf.c -o src/core/bpf/clat.bpf.unstripped.o

But I am not sure that this complain is quite correct when compiling
bpf. I can imagine `-Wformat -Werror=format-security` and `-g` might be
fair to include. But note that `-gbtf` is enabled, and should subsume `-g`.

Do note also that upstream of the project did explicitly set
`-fno-stack-protector`, likely due to issues with it in bpf programs.

And `_FORTIFY_SOURCE=2` probably does not apply to bpf programs either,
at least as of now.

Trying to set some of these flags I get errors like:

[413/1088] /usr/bin/bpf-gcc -std=gnu17 -Wunused -Wimplicit-fallthrough -fno-stack-protector -fno-ssa-phiopt -O2 -mcpu=v3 -mco-re -gbtf -g -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -D__x86_64__ -mlittle-endian -I. -isystem /usr/include/x86_64-linux-gnu -idirafter /usr/include ../src/core/bpf/clat.bpf.c -o src/core/bpf/clat.bpf.unstripped.o
FAILED: [code=1] src/core/bpf/clat.bpf.unstripped.o
/usr/bin/bpf-gcc -std=gnu17 -Wunused -Wimplicit-fallthrough -fno-stack-protector -fno-ssa-phiopt -O2 -mcpu=v3 -mco-re -gbtf -g -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -D__x86_64__ -mlittle-endian -I. -isystem /usr/include/x86_64-linux-gnu -idirafter /usr/include ../src/core/bpf/clat.bpf.c -o src/core/bpf/clat.bpf.unstripped.o
cc1: note: ‘-fstack-protector’ does not work on this architecture
cc1: error: ‘-fcf-protection=full’ is not supported for this target


Regards,
Witold