nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-09-21 05:26:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix for bug #5210: enable GCC and LD hardening by default

Browse Source
This commit is contained in:
Florent Daigniere 2012-03-15 10:02:30 +00:00
parent 4ade55ecb9
commit 62f3121a3d
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
changes/bug5210 Normal file
View File

@ -0,0 +1,2 @@
o Security fixes:
- Enable gcc and ld hardening by default. Fixes bug 5210.

12
configure.in
View File

@ -122,19 +122,23 @@ dnl -D_FORTIFY_SOURCE=2 -fstack-protector-all
dnl Others suggest '/gs /safeseh /nxcompat /dynamicbase' for non-gcc on Windows
dnl This requires that we use gcc and that we add -O2 to the CFLAGS.
AC_ARG_ENABLE(gcc-hardening,
AS_HELP_STRING(--enable-gcc-hardening, enable compiler security checks),
AS_HELP_STRING(--disable-gcc-hardening, disable compiler security checks),
[],
[enableval=yes;])
[if test x$enableval = xyes; then
CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all"
CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector"
CFLAGS="$CFLAGS --param ssp-buffer-size=1"
LDFLAGS="$LDFLAGS -pie"
fi])
fi]
dnl Linker hardening options
dnl Currently these options are ELF specific - you can't use this with MacOSX
AC_ARG_ENABLE(linker-hardening,
AS_HELP_STRING(--enable-linker-hardening, enable linker security fixups),
[if test x$enableval = xyes; then
AS_HELP_STRING(--disable-linker-hardening, disable linker security fixups),
[],
[enableval=yes;])
AC_CHECK_HEADER([elf.h], [if test x$enableval = xyes; then
LDFLAGS="$LDFLAGS -z relro -z now"
fi])