900-configure-hardening.patch 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556
  1. --- a/configure.ac
  2. +++ b/configure.ac
  3. @@ -70,53 +70,6 @@ AC_ARG_ENABLE(harden,
  4. if test "$hardenbuild" -eq 1; then
  5. AC_MSG_NOTICE(Checking for available hardened build flags:)
  6. - # relocation flags don't make sense for static builds
  7. - if test "$STATIC" -ne 1; then
  8. - # pie
  9. - DB_TRYADDCFLAGS([-fPIE])
  10. -
  11. - OLDLDFLAGS="$LDFLAGS"
  12. - TESTFLAGS="-Wl,-pie"
  13. - LDFLAGS="$LDFLAGS $TESTFLAGS"
  14. - AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
  15. - [AC_MSG_NOTICE([Setting $TESTFLAGS])],
  16. - [
  17. - LDFLAGS="$OLDLDFLAGS"
  18. - TESTFLAGS="-pie"
  19. - LDFLAGS="$LDFLAGS $TESTFLAGS"
  20. - AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
  21. - [AC_MSG_NOTICE([Setting $TESTFLAGS])],
  22. - [AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ]
  23. - )
  24. - ]
  25. - )
  26. - # readonly elf relocation sections (relro)
  27. - OLDLDFLAGS="$LDFLAGS"
  28. - TESTFLAGS="-Wl,-z,now -Wl,-z,relro"
  29. - LDFLAGS="$LDFLAGS $TESTFLAGS"
  30. - AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
  31. - [AC_MSG_NOTICE([Setting $TESTFLAGS])],
  32. - [AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ]
  33. - )
  34. - fi # non-static
  35. - # stack protector. -strong is good but only in gcc 4.9 or later
  36. - OLDCFLAGS="$CFLAGS"
  37. - TESTFLAGS="-fstack-protector-strong"
  38. - CFLAGS="$CFLAGS $TESTFLAGS"
  39. - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
  40. - [AC_MSG_NOTICE([Setting $TESTFLAGS])],
  41. - [
  42. - CFLAGS="$OLDCFLAGS"
  43. - TESTFLAGS="-fstack-protector --param=ssp-buffer-size=4"
  44. - CFLAGS="$CFLAGS $TESTFLAGS"
  45. - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
  46. - [AC_MSG_NOTICE([Setting $TESTFLAGS])],
  47. - [AC_MSG_NOTICE([Not setting $TESTFLAGS]); CFLAGS="$OLDCFLAGS" ]
  48. - )
  49. - ]
  50. - )
  51. - # FORTIFY_SOURCE
  52. - DB_TRYADDCFLAGS([-D_FORTIFY_SOURCE=2])
  53. # Spectre v2 mitigations
  54. DB_TRYADDCFLAGS([-mfunction-return=thunk])