1 files changed, 4 insertions, 4 deletions

diff --git a/Makefile b/Makefile
index eed77a0..7ed552c 100644
--- a/Makefile
+++ b/Makefile
@@ -46,9 +46,9 @@ OT_CFLAGS+=-Wall -Wextra -Wwrite-strings -pipe -pthread
 
 HARDENING=-fstack-protector-strong -fPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
 HARDENING_LD=-pie
-# Full RELRO is free at runtime and makes the GOT read-only, but Apple's linker
-# does not accept -z, so enable it for the GNU-style linkers (Linux, the BSDs):
-#HARDENING_LD+=-Wl,-z,relro,-z,now
+# Full RELRO on every linker that takes it, which is all but Apple's. See DESIGN.
+RELRO_LD!=      case `uname -s` in Darwin) ;; *) printf %s -Wl,-z,relro,-z,now ;; esac
+HARDENING_LD+=$(RELRO_LD)
 OT_LDFLAGS+=-pthread
 
 OPTS_debug=-D_DEBUG -g -ggdb
@@ -78,7 +78,7 @@ $(BINARY).debug: $(SOURCES) $(HEADERS) $(BUILDDEPS)
         $(CC) -o $@ $(OPTS_debug) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD)
 
 $(BUILDSTAMP): FORCE
-        @echo "$(CFLAGS) $(COMPILE) $(LINK)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(LINK)" > $@
+        @echo "$(CFLAGS) $(COMPILE) $(HARDENING) $(LINK) $(HARDENING_LD)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(HARDENING) $(LINK) $(HARDENING_LD)" > $@
 
 clean:
         rm -rf $(BINARIES) $(BINARIES:=.dSYM) $(BUILDSTAMP) *.o *~ src/*.o src/*~