diff options
| author | Andrew Morrow <acm@mongodb.com> | 2016-09-24 11:38:06 -0400 |
|---|---|---|
| committer | Andrew Morrow <acm@mongodb.com> | 2016-09-26 12:32:16 -0400 |
| commit | 613cd2c422fcd9fdac6a21a6d5bd5f333018ff11 (patch) | |
| tree | 8fc8de2618fec837b0ca217f5bf2f4cd0b2f1176 | |
| parent | e2b8d3da53a06617fa9c0251070bfc31fe38f154 (diff) | |
| download | mongo-613cd2c422fcd9fdac6a21a6d5bd5f333018ff11.tar.gz | |
SERVER-26311 Enable stack protection for clang builds
| -rw-r--r-- | SConstruct | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/SConstruct b/SConstruct index 897ef8ac76b..5e0d77d74bc 100644 --- a/SConstruct +++ b/SConstruct @@ -1915,11 +1915,10 @@ def doConfigure(myenv): conf.Finish() if get_option('runtime-hardening') == "on": - # Clang honors these flags, but doesn't actually do anything with them for compatibility, so we - # need to only do this for GCC. On clang, we do things differently. Note that we need to add - # these to the LINKFLAGS as well, since otherwise we might not link libssp when we need to (see - # SERVER-12456). - if myenv.ToolchainIs('gcc'): + # Enable 'strong' stack protection preferentially, but fall back to 'all' if it is not + # available. Note that we need to add these to the LINKFLAGS as well, since otherwise we + # might not link libssp when we need to (see SERVER-12456). + if myenv.ToolchainIs('gcc', 'clang'): if AddToCCFLAGSIfSupported(myenv, '-fstack-protector-strong'): myenv.Append( LINKFLAGS=[ @@ -1932,10 +1931,10 @@ def doConfigure(myenv): '-fstack-protector-all', ] ) - elif myenv.ToolchainIs('clang'): - # TODO: Clang stack hardening. There are several interesting - # things to try here, but they each have consequences we need - # to investigate. + + if myenv.ToolchainIs('clang'): + # TODO: There are several interesting things to try here, but they each have + # consequences we need to investigate. # # - fsanitize=bounds: This does static bounds checking. We can # probably turn this on along with fsanitize-trap so that we |