notwa/rc
1
0
Fork 0
mirror of https://github.com/notwa/rc synced 2025-03-18 15:45:38 -07:00
Code Issues Releases Wiki Activity

add a basic hardened mode

Browse source
This commit is contained in:
Connor Olding 2017-03-31 03:49:47 +00:00
parent c259cbca35
commit 4e7caf55ae
1 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
sh/compile
View file

@ -43,6 +43,14 @@ compile() {
local debug_flags=(-O1 -g);
local release_flags=(-Ofast -march=native -g0 -fomit-frame-pointer -s -DNDEBUG)
local dr_flags=(-Ofast -march=native -g -fomit-frame-pointer -DNDEBUG)
local hardened_flags=(-O3 -march=native -g0 -s
-DNDEBUG -D_FORTIFY_SOURCE=2
-Wformat -Wformat-security -Werror=format-security)
if [ -z $MSYSTEM ]; then
hardened_flags+=(-fPIE -pie)
hardened_flags+=(-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now)
fi
if [ -e /usr/bin/pprof ]; then
local malloc=(-ltcmalloc -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free)
@ -63,14 +71,19 @@ compile() {
debug_flags+=(-fsanitize=undefined) # this SHOULD work with mingw,
# but it fails to link.
debug_flags+=(-fsanitize=address)
debug_flags+=(-fvisibility=hidden -flto -fsanitize=cfi)
debug_flags+=(-fvisibility=hidden -fuse-ld=gold -flto -fsanitize=cfi)
hardened_flags+=(-fsanitize=safe-stack)
hardened_flags+=(-fstack-protector-strong)
hardened_flags+=(-fvisibility=hidden -fuse-ld=gold -flto -fsanitize=cfi)
fi
fi
{ [ $1 = debug ] && our_flags+=($debug_flags) && shift } || \
{ [ $1 = release ] && our_flags+=($release_flags) && shift } || \
{ [ $1 = derelease ] && our_flags+=($dr_flags) && shift } || \
{ echo "please specify either debug or (de)release" >&2; return 1 }
{ [ $1 = hardened ] && our_flags+=($hardened_flags) && shift } || \
{ echo "please specify either debug or (de)release or hardened" >&2; return 1 }
# TODO add static option