Add control-flow protection

This commit is contained in:
inference 2023-10-14 19:07:06 +01:00
parent 74dc6d6b0a
commit 3e1d8116d1
Signed by: inference
SSH Key Fingerprint: SHA256:FtEVfx1CmTKMy40VwZvF4k+3TC+QhCWy+EmPRg50Nnc

View File

@ -4,7 +4,7 @@
# Copyright 2022 Jake Winters # Copyright 2022 Jake Winters
# SPDX-License-Identifier: BSD-3-Clause # SPDX-License-Identifier: BSD-3-Clause
# Version: 16.0.0-alpha.1+45 # Version: 16.0.0-alpha.2+46
# System # System
@ -36,7 +36,7 @@ PORTAGE_RSYNC_EXTRA_OPTS="--progress --verbose"
# Flags # Flags
## Hardening flags ## Hardening flags
C_SEC="-fstack-clash-protection -fstack-protector-strong -ftrivial-auto-var-init=zero -fwrapv" C_SEC="-fcf-protection=full -fstack-clash-protection -fstack-protector-strong -ftrivial-auto-var-init=zero -fwrapv"
LD_SEC="-Wl,-z,defs -Wl,-z,now -Wl,-z,relro" LD_SEC="-Wl,-z,defs -Wl,-z,now -Wl,-z,relro"
## Compiler flags ## Compiler flags
CFLAGS="-flto=thin -march=znver3 -mtune=znver3 --optimize=2 -pipe ${C_SEC}" CFLAGS="-flto=thin -march=znver3 -mtune=znver3 --optimize=2 -pipe ${C_SEC}"