CLANG-LOCAL(1)

🌸 NAME 🌸

clang-local — the OpenBSD-specific behavior of LLVM/clang, bestie 💅. It's from the General Commands Manual, and it's literally all about how clang hits different when it's the system compiler on OpenBSD. 👑

✨ DESCRIPTION ✨

Okay so picture this: on OpenBSD, the LLVM/clang compiler has these exact traits, and they're all main-character energy. Vibe check time:

• No /usr/local hunting — clang does not search under /usr/local for include files or libraries. As a system compiler, it only searches the system paths by default. No cap. 🎀
• Stack protection is on by default — equivalent to the -fstack-protector-strong option on other systems. The system will report any violation of the stack protector cookie along with the function name via syslog(3) at LOG_CRIT priority. 😭
• PIE code by default — clang will generate PIE code by default, allowing the system to load the resulting binary at a random location. This behavior can be turned off by passing -fno-pie to the compiler and -nopie to the linker. It is also turned off when the -pg flag is used. 🎀
• -fstrict-aliasing is off by default — unless -Ofast has been selected. That's the whole vibe. ✨
• No version string in objects — clang does not store its version string in objects. There is no option to control this. Literally none. 🙈
• -p is an alias of -pg — that's it, that's the tweet. 💅
• No signedness warnings outside -pedantic — clang does not warn for passing pointer arguments or assignment with different signedness outside of -pedantic. This can be re-enabled with the -Wpointer-sign flag. 🔥
• -Waddress-of-packed-member is disabled by default — yep, that warning option is off unless you turn it on. 👑
• Color diagnostics are disabled by default — color diagnostic messages are disabled by default and can be re-enabled with -fdiagnostics-color. 🌈
• -fwrapv is enabled by default — the -fwrapv option to treat signed integer overflows as defined is enabled by default to prevent dangerous optimizations which could remove security critical overflow checks. This one is security critical, fr fr. 🫶
• Minimal ubsan only — the base system includes the ubsan_minimal sanitizer runtime but not the fully-featured ubsan runtime. See the documentation for the -fsanitize-minimal-runtime flag. 🧚
• Some builtins are disabled — the malloc(3), calloc(3), realloc(3), strdup(3), strndup(3), valloc(3) and free(3) builtins are disabled to prevent undesirable optimizations of calls to these functions. Periodt. 💖
• ROP-friendly instruction swap — clang includes a security pass that exchanges some ROP-friendly instructions with safer alternatives on i386 and amd64. This can be disabled with the -fno-fixup-gadgets option. 🦋
• Return-address clearing — clang includes a security pass that can clear the return address on the stack upon return from calling a function, on i386 and amd64. This can be enabled with the -fret-clean option. ⭐
• retguard — clang includes the retguard security feature on amd64, arm64, mips64, powerpc and powerpc64. This feature can be disabled with the -fno-ret-protector or -fno-stack-protector options. 👑
• -mretpoline on amd64 — clang has -mretpoline enabled by default on amd64 to protect against branch target injection attacks. It can be disabled with -mno-retpoline. 💀
• New %n warning — a new warning for %n format specifier usage in printf(3) family functions has been added. Slay. ✨

---

🦋 SEE ALSO 🦋

• clang(1) — go read that one too, bestie. 💖

This page is from Debian, dated June 2, 2024. Bye bestie, mwah 💋