Inferencium/cfg
1
0
Fork 0
Code Issues Activity

Remove FORTIFY_SOURCE since it is not compatible with or used by musl libc. Switch stack protector from all to strong since strong covers the entire practical stack smashing protection threat model. Switch -ftrivial-auto-var-init from pattern to zero since it is no longer being removed from Clang and is more suitable for hardening. Sort compiler flags A-Z.

Browse Source
This commit is contained in:
inference 2023-01-17 01:49:32 +00:00
parent e43700cfc0
commit d91d5d5158
Signed by: inference
SSH Key Fingerprint: SHA256:9Pl0nZ2UJacgm+IeEtLSZ4FOESgP1eKCtRflfPfdX9M
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
portage/env/nopie.conf vendored
View File

@ -3,15 +3,15 @@
# Copyright 2022-2023 Inference # Copyright 2022-2023 Inference
# SPDX-License-Identifier: BSD-3-Clause-Clear # SPDX-License-Identifier: BSD-3-Clause-Clear
# Version: 1.0.0.2 # Version: 2.0.0.3
# Flags # Flags
## Hardening flags ## Hardening flags
C_SEC="-fPIE -fPIC -fstack-protector-all -fstack-clash-protection -D_FORTIFY_SOURCE=2 -ftrivial-auto-var-init=pattern -fwrapv" C_SEC="-fPIC -fPIE -fstack-clash-protection -fstack-protector-strong -ftrivial-auto-var-init=zero -fwrapv"
LD_SEC="-Wl,--strip-all -Wl,-z,defs -Wl,-z,now -Wl,-z,relro" LD_SEC="-Wl,--strip-all -Wl,-z,defs -Wl,-z,now -Wl,-z,relro"
## Compiler flags ## Compiler flags
CFLAGS="-march=znver3 -mtune=znver3 -O2 -pipe -flto=thin -U__gnu_linux__ ${C_SEC}" CFLAGS="-flto=thin -march=znver3 -mtune=znver3 -O2 -pipe -U__gnu_linux__ ${C_SEC}"
CXXFLAGS="-march=znver3 -mtune=znver3 -O2 -pipe -flto=thin ${C_SEC}" CXXFLAGS="-flto=thin -march=znver3 -mtune=znver3 -O2 -pipe ${C_SEC}"
## Linker flags ## Linker flags
LDFLAGS="-fuse-ld=lld -rtlib=compiler-rt -unwindlib=libunwind -Wl,--thinlto-jobs=4 ${LD_SEC}" LDFLAGS="-fuse-ld=lld -rtlib=compiler-rt -unwindlib=libunwind -Wl,--thinlto-jobs=4 ${LD_SEC}"