Use -fstack-check when compiling C code

[briansmith]

See https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt.

[briansmith]

https://twitter.com/CopperheadOS/status/876835207701200896: "A simple, important mitigation like -fstack-check is a no-op in Clang and broken in GCC: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68065, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66479."

[sanmai-NL]

-fstack-check is a no-op in Clang

See also copperhead/bugtracker#308.

---

@briansmith: Am I correct in believing that the current status as discussed under rust-lang/rust#43241 means CopperheadOS’ comments on Twitter are outdated wrt. Stack Clash protection for tier-1 platforms?

[thestinger]

You should pass -fstack-clash-protection to GCC. Clang doesn't support it yet.

GCC implemented -fstack-clash-protection instead of fixing -fstack-check. You don't want -fstack-check. I don't think they plan to fix it. :\