Add -D_LIBCPP_ENABLE_HARDENED_MODE=1

[david-a-wheeler]

We should probably add -D_LIBCPP_ENABLE_HARDENED_MODE=1. It helps for C++ when using libc++ and the LLVM compiler. See: https://libcxx.llvm.org/Hardening.html#using-hardening-modes

[thesamesam]

This bug is essentially a dupe of #149. LLVM keeps changing the option name. Please see #149 (comment) in particular.

[thomasnyman]

Thanks @thesamesam for keeping us updated on this. We jumped the gun a bit with the deprecation notes for the older macros as we were basing this on the proposed changes to LLVM 17. Given that these and the older alternatives have been unstable in the past, I would suggest we wait with further additions to the guide until the new hardened mode becomes available in a LLVM release, hopefully with LLVM 18.0.

[thomasnyman]

It seems libc++ documentation has received a page on Hardening modes that seems to match the proposal from November in 2023 in the Hardening RFC.

Can anyone with more insight into the discussions around these comment on whether the documented modes can be considered stable?

[thesamesam]

I believe the now-documented modes aren't going to change. I can't promise that, but we haven't seen any discussions of changes, and have been using the new ones for a few releases in Gentoo now. I've also updated Meson to use them.

[var-const]

Hello! I would be happy to create a PR to add some recommendations on using the libc++ hardening modes to the relevant section of the guide. They are indeed stable now and we have no intention to change them. Please let me know if you would be open to reviewing the PR and if yes, whether there's anything I should be aware of before proceeding (I'm not familiar with the process around editing the guide, though of course I will do my best to try and match the general style and format).

[thesamesam]

I'm very happy to review such a PR, thank you! I'll let others comment on if there's any particular guide (not aware of one) but I found others were quite helpful with pointing out any sort of style changes I needed.

[david-a-wheeler]

@var-const - just do your best on your proposed change, and we can fix things up from there.

I understand this is LLVM-specific. In section 1 we provide our list of "always turn on these flags", followed by a table giving various conditions and what to add in them. We currently have a row for "using GCC" but no corresponding "using clang" row. I suggest adding a row "using clang" and the new option. Then, further below, provide more information about the option. If there are cases where it should NOT be used, note that in those details.

[var-const]

Thank you, @thesamesam and @david-a-wheeler! I will take a stab after the holiday break (unless somebody beats me to it :)). Cc @ldionne for visibility.

[thomasnyman]

Thank you for volunteering @var-const! I'm also happy to review once you have a draft. I've assigned you to this issue to make it more visible at a glance that it is being worked on.

[thomasnyman]

@var-const Are you still interested in this?

[var-const]

@thomasnyman Sorry about the radio silence. I'm very much interested, unfortunately a combination of work and personal reasons leaves me with zero time to work on this right now. I really hope I can get to this soon, perhaps next week.