diff --git a/portage/env/nolto-nopie.conf b/portage/env/nolto-nopie.conf index a231347..a8c7328 100644 --- a/portage/env/nolto-nopie.conf +++ b/portage/env/nolto-nopie.conf @@ -20,7 +20,7 @@ OBJDUMP="llvm-objdump" # Flags. ## Hardening flags. -C_HARDENING="-fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2" +C_HARDENING="-fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2 -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang -fwrapv" LD_HARDENING="-Wl,--strip-all -Wl,-z,defs -Wl,-z,now -Wl,-z,relro" ## Common flags. diff --git a/portage/env/nolto.conf b/portage/env/nolto.conf index e4f64c1..11bf8ca 100644 --- a/portage/env/nolto.conf +++ b/portage/env/nolto.conf @@ -20,7 +20,7 @@ OBJDUMP="llvm-objdump" # Flags. ## Hardening flags. -C_HARDENING="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2" +C_HARDENING="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2 -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang -fwrapv" LD_HARDENING="-Wl,-pie -Wl,--strip-all -Wl,-z,defs -Wl,-z,now -Wl,-z,relro" ## Common flags. diff --git a/portage/env/nopie.conf b/portage/env/nopie.conf index c9ce5ed..7870ff3 100644 --- a/portage/env/nopie.conf +++ b/portage/env/nopie.conf @@ -20,7 +20,7 @@ OBJDUMP="llvm-objdump" # Flags. ## Hardening flags. -C_HARDENING="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2" +C_HARDENING="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2 -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang -fwrapv" LD_HARDENING="-Wl,--strip-all -Wl,-z,defs -Wl,-z,now -Wl,-z,relro" ## Common flags. diff --git a/portage/env/werror.conf b/portage/env/werror.conf index 558d6ee..6372b83 100644 --- a/portage/env/werror.conf +++ b/portage/env/werror.conf @@ -20,7 +20,7 @@ OBJDUMP="llvm-objdump" # Flags. ## Hardening flags. -C_HARDENING="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2" +C_HARDENING="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2 -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang -fwrapv" LD_HARDENING="-Wl,-z,now -Wl,-z,relro -pie -Wl,--strip-all" ## Common flags. diff --git a/portage/make.conf b/portage/make.conf index 5739d34..5a4e5b1 100644 --- a/portage/make.conf +++ b/portage/make.conf @@ -20,7 +20,7 @@ STRIP="llvm-strip" # Flags. ## Hardening flags. -C_SEC="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2" +C_SEC="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2 -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang -fwrapv" LD_SEC="-Wl,-pie -Wl,--strip-all -Wl,-z,defs -Wl,-z,now -Wl,-z,relro" ## Common flags.