diff options
| author | Peter Rajnoha <prajnoha@redhat.com> | 2013-12-04 10:16:15 +0100 |
|---|---|---|
| committer | Peter Rajnoha <prajnoha@redhat.com> | 2013-12-04 13:30:08 +0100 |
| commit | a65ab773b4ddb06e87d678d3b2f4d0ca3e5b9fd0 (patch) | |
| tree | a04e5f178ec68827d4fc40710ea3d0ec1877f1b6 /make.tmpl.in | |
| parent | fc37d4fb0dfc47c49b8acdc773a4ad67d59b51b8 (diff) | |
| download | lvm2-a65ab773b4ddb06e87d678d3b2f4d0ca3e5b9fd0.tar.gz | |
daemons: use PIE and RELRO compiler/linker options
The PIE and RELRO compiler/linker options can be used to produce a code
some techniques applied that makes the code more immune to some attacks:
- PIE (Position Independent Executable). It can make use of the ASLR
(Address Space Layout Randomization) provided by kernel to avoid
static locations for .text regions of executables (this is the 'pie'
compiler and linker option)
- RELRO (Relocation Read-Only). This prevents overwrite attacks of
the GOT (Global Offset Table) and PLT (Procedure Lookup Table)
used for relocations by making it read-only after all relocations
are resolved (these are the 'relro' and 'now' linker options) -
hence all symbols are resolved at the very start so there's no
need for those tables to be writeable later.
These compiler/linker options are now used by default for daemons
if the compiler/linker supports it.
Diffstat (limited to 'make.tmpl.in')
| -rw-r--r-- | make.tmpl.in | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/make.tmpl.in b/make.tmpl.in index 944be9b68..5f72182b7 100644 --- a/make.tmpl.in +++ b/make.tmpl.in @@ -150,6 +150,15 @@ WFLAGS += -Wclobbered -Wempty-body -Wignored-qualifiers \ -Wtype-limits -Wsync-nand -Wlogical-op endif +ifneq ("@STATIC_LINK@", "yes") +ifeq ("@HAVE_PIE@", "yes") +ifeq ("@HAVE_FULL_RELRO@", "yes") + DAEMON_CFLAGS += -fPIE -DPIE + DAEMON_LDFLAGS += -Wl,-z,relro,-z,now -pie +endif +endif +endif + #WFLAGS += -W -Wno-sign-compare -Wno-unused-parameter -Wno-missing-field-initializers #WFLAGS += -Wsign-compare -Wunused-parameter -Wmissing-field-initializers #WFLAGS += -Wconversion -Wbad-function-cast -Wcast-qual -Waggregate-return -Wpacked |