Remove FORTIFY_SOURCE since it is not compatible with or used by musl libc. Switch stack protector from all to strong since strong covers the entire practical stack smashing protection threat model. Switch -ftrivial-auto-var-init from pattern to zero since it is no longer being removed from Clang and is more suitable for hardening.
This commit is contained in:
parent
a244fd9746
commit
2b77e163f4
@ -3,7 +3,7 @@
|
||||
# Copyright 2022-2023 Inference
|
||||
# SPDX-License-Identifier: BSD-3-Clause-Clear
|
||||
|
||||
# Version: 6.0.0.29
|
||||
# Version: 7.0.0.30
|
||||
|
||||
|
||||
# System
|
||||
@ -50,7 +50,7 @@ STRIP="llvm-strip"
|
||||
|
||||
# Flags
|
||||
## Hardening flags
|
||||
C_SEC="-D_FORTIFY_SOURCE=2 -fPIC -fPIE -fstack-clash-protection -fstack-protector-all -ftrivial-auto-var-init=pattern -fwrapv"
|
||||
C_SEC="-fPIC -fPIE -fstack-clash-protection -fstack-protector-strong -ftrivial-auto-var-init=zero -fwrapv"
|
||||
LD_SEC="-Wl,-z,defs -Wl,-z,now -Wl,-pie -Wl,-z,relro -Wl,--strip-all"
|
||||
## Compiler flags
|
||||
CFLAGS="-march=znver3 -mtune=znver3 -O2 -pipe -flto=thin -U__gnu_linux__ ${C_SEC}"
|
||||
|
Loading…
x
Reference in New Issue
Block a user