`security-check.py` produces false positive result for stack smashing protection #29084

I'm aware that test-security-check.py tests both cases -fno-stack-protector and -fstack-protector-all.

However, the security-check.py passes in the master branch @ 986047170892c9482ccbc21f05bf4f1499b3089d with the diff as follows:

--- a/configure.ac
+++ b/configure.ac
@@ -935,7 +935,7 @@ fi
 if test "$use_hardening" != "no"; then
   use_hardening=yes
   AX_CHECK_COMPILE_FLAG([-Wstack-protector], [HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -Wstack-protector"])
-  AX_CHECK_COMPILE_FLAG([-fstack-protector-all], [HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fstack-protector-all"])
+  AX_CHECK_COMPILE_FLAG([-fno-stack-protector], [HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fno-stack-protector"])
 
   AX_CHECK_COMPILE_FLAG([-fcf-protection=full], [HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fcf-protection=full"])
 

To reproduce, please run env HOSTS=x86_64-linux-gnu ./contrib/guix/guix-build.

Probably because our GCC in guix is passing stack protection flags by default?

Probably because our GCC in guix is passing stack protection flags by default?

Shouldn't -fno-stack-protector override compiler's defaults?

Probably because our GCC in guix is passing stack protection flags by default?

Why does the test-security-check.py pass then?

Probably because the toolchain is built hardened, so any test bin still has the stack protection symbol coming from glibc or similar.

The claim here is that if you change -fstack-protector-all to -fno-stack-protector in our compile flags, then check_ELF_Canary in security-check.py should fail during a Guix build.

However that wont happen, because the check looks for the presence of __stack_chk_fail, and that will still be in the binary, because libs in depends are compiled with the on-by-default stack-protector flags. This can easily be checked after Guix building with the diff above:

  CXXFLAGS        =    -Wstack-protector -fno-stack-protector -fcf-protection=full -fstack-clash-protection      -fno-extended-identifiers -fstack-reuse=none -fvisibility=hidden -pipe -std=c++20 -O2 -O2 -g -ffile-prefix-map=/gnu/store/dyzpk3myxgx3asavbcd9aspa9gvbyxcr-profile=/usr
....
/bitcoin/guix-build-c5f12669c591/distsrc-c5f12669c591-x86_64-linux-gnu/src# nm -C bitcoind | grep __stack
                 U __stack_chk_fail@GLIBC_2.4

Going to close this, as there is no false-positive as far as I can see.