Support go compiler flags for address sanitization and spectre mitigations #4591
Labels
1-low
priority denoting isolated changes
enhancement
New feature or request
security_audit
Track issues that are related to CVE/CVSS/CWE auditing etc
Projects
Comments
bnevis-i
added
enhancement
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
馃殌 Feature Request
Relevant Package [REQUIRED]
All golang components.
Description [REQUIRED]
A number of new security flags have been added to golang that should be integrated into our makefiles.
For binaries that interact with legacy C libraries, we should enable address sanitization,
-msan -asan:golang/go#44853
There are also flags to mitigate against speculative execution attacks,
-spectre=index,rethttps://zchee.github.io/golang-wiki/Spectre/
Potentially, can do this:
GOFLAGS=-trimpath -mod=readonly -asmflags=all="-spectre=all" -gcflags=all="-spectre=all" -ldflags="-s -w"
The text was updated successfully, but these errors were encountered: