Add hardening parameters to the default builds

1 files changed, 8 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index 2b8ad92..eed77a0 100644
--- a/Makefile
+++ b/Makefile
@@ -43,6 +43,12 @@ include Mk/gzip.mk
 CFLAGS?=-O3
 
 OT_CFLAGS+=-Wall -Wextra -Wwrite-strings -pipe -pthread
+
+HARDENING=-fstack-protector-strong -fPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
+HARDENING_LD=-pie
+# Full RELRO is free at runtime and makes the GOT read-only, but Apple's linker
+# does not accept -z, so enable it for the GNU-style linkers (Linux, the BSDs):
+#HARDENING_LD+=-Wl,-z,relro,-z,now
 OT_LDFLAGS+=-pthread
 
 OPTS_debug=-D_DEBUG -g -ggdb
@@ -65,11 +71,11 @@ BUILDDEPS=Makefile $(BUILDSTAMP)
 all: $(BINARY) $(BINARY).debug
 
 $(BINARY): $(SOURCES) $(HEADERS) $(BUILDDEPS)
-        $(CC) -o $@ $(CFLAGS) $(COMPILE) $(SOURCES) $(LINK)
+        $(CC) -o $@ $(CFLAGS) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD)
         $(STRIP) $@
 
 $(BINARY).debug: $(SOURCES) $(HEADERS) $(BUILDDEPS)
-        $(CC) -o $@ $(OPTS_debug) $(COMPILE) $(SOURCES) $(LINK)
+        $(CC) -o $@ $(OPTS_debug) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD)
 
 $(BUILDSTAMP): FORCE
         @echo "$(CFLAGS) $(COMPILE) $(LINK)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(LINK)" > $@