diff options
| author | Craig Small <csmall@enc.com.au> | 2016-04-25 17:07:22 +1000 |
|---|---|---|
| committer | Craig Small <csmall@enc.com.au> | 2016-04-25 17:07:22 +1000 |
| commit | 9c877bf636401faec1df5934eb69a3775077be4d (patch) | |
| tree | 5d0953805a2ae072261d00bb561297f1c4018a10 /configure.ac | |
| parent | 1e6452fe65706da3bf23d13f469e348d4f8519d3 (diff) | |
| download | procps-ng-9c877bf636401faec1df5934eb69a3775077be4d.tar.gz | |
build-sys: Enable optional hardening flags
With the configure option --enable-harden-flags the CFLAGS and
LDFLAGS are manipulated to provide some hardening protection
to the binaries.
psmisc uses these flags on by default with no troubles, however
it doesn't have a library in it either.
References:
https://wiki.debian.org/Hardening
Diffstat (limited to 'configure.ac')
| -rw-r--r-- | configure.ac | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac index 32d0f72..7190650 100644 --- a/configure.ac +++ b/configure.ac @@ -116,6 +116,29 @@ if test "$enable_libselinux" = "yes"; then AC_DEFINE([ENABLE_LIBSELINUX], [1], [Enable libselinux]) fi +# Enable hardened compile and link flags +AC_ARG_ENABLE([harden_flags], + [AS_HELP_STRING([--enable-harden-flags], [enable hardened compilier and linker flags])], + [enable_harden_flags=$enableval], + [enable_harden_flags="no"]) + +# Check that harden CFLAGS and LDFLAGS will compile +AS_IF([test "$enable_harden_flags" = "yes"], + HARDEN_CFLAGS="-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security" + [HARDEN_LDFLAGS="-fPIE -pie -Wl,-z,relro -Wl,-z,now"] + [ AC_MSG_CHECKING([compiler supports harden flags]) + save_harden_cflags="$CFLAGS" + CFLAGS="$CFLAGS $HARDEN_CFLAGS" + AC_COMPILE_IFELSE([AC_LANG_PROGRAM(,,)], + [AC_MSG_RESULT([yes])], + [AC_MSG_RESULT([no]); HARDEN_CFLAGS=''] + ) + CFLAGS="$save_harden_cflags"], + [HARDEN_CFLAGS="" + HARDEN_LDFLAGS=""]) +AC_SUBST([HARDEN_CFLAGS]) +AC_SUBST([HARDEN_LDFLAGS]) + # Optional packages - AC_ARG_WITH AC_ARG_WITH([ncurses], AS_HELP_STRING([--without-ncurses], [build only applications not needing ncurses]), |