From 4a01fea4a96374a1359d43a280a236a3ea042a1c Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Fri, 6 Nov 2026 19:09:43 +0100 Subject: Enable RELRO everywhere than macos --- DESIGN | 9 ++++++++- Makefile | 8 ++++---- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/DESIGN b/DESIGN index b6e2050..b25b37c 100644 --- a/DESIGN +++ b/DESIGN @@ -116,13 +116,20 @@ Build hardening the shipped binary ---------------------------------- The production and debug binaries carry -fstack-protector-strong, PIE and -_FORTIFY_SOURCE=2; a GNU-style linker also gets full RELRO. Measured cost on +_FORTIFY_SOURCE=2; every linker but Apple's also gets full RELRO (-z relro,-z now). Measured cost on the announce hot path is 300 to 305 nanoseconds, under two per cent, and the individual flags sit inside the run-to-run noise: add_peer has few stack buffers, most buffer sizes are known at compile time so FORTIFY emits no runtime check, and PIE on arm64 is almost free. On x86-64 PIE costs a little more. End to end it is invisible, since a UDP announce is mostly kernel time. +RELRO is gated on the operating system because Apple's linker rejects -z. The +branch runs in the shell through a != assignment, the one form both bmake and +GNU make 4 accept; $(shell) is GNU only and GNU make 3.81, which stock macOS +ships, has neither. On that old make the != line is inert and leaves RELRO +empty, which is the right answer for macOS anyway, so every platform resolves +correctly without a make conditional. + The flags are not in OT_CFLAGS, so the sanitizer test builds do not inherit them. AddressSanitizer checks harder than FORTIFY does, and the two clash on FreeBSD, where a FORTIFY plus ASan build aborted a multi hash scrape that the diff --git a/Makefile b/Makefile index eed77a0..7ed552c 100644 --- a/Makefile +++ b/Makefile @@ -46,9 +46,9 @@ OT_CFLAGS+=-Wall -Wextra -Wwrite-strings -pipe -pthread HARDENING=-fstack-protector-strong -fPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 HARDENING_LD=-pie -# Full RELRO is free at runtime and makes the GOT read-only, but Apple's linker -# does not accept -z, so enable it for the GNU-style linkers (Linux, the BSDs): -#HARDENING_LD+=-Wl,-z,relro,-z,now +# Full RELRO on every linker that takes it, which is all but Apple's. See DESIGN. +RELRO_LD!= case `uname -s` in Darwin) ;; *) printf %s -Wl,-z,relro,-z,now ;; esac +HARDENING_LD+=$(RELRO_LD) OT_LDFLAGS+=-pthread OPTS_debug=-D_DEBUG -g -ggdb @@ -78,7 +78,7 @@ $(BINARY).debug: $(SOURCES) $(HEADERS) $(BUILDDEPS) $(CC) -o $@ $(OPTS_debug) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD) $(BUILDSTAMP): FORCE - @echo "$(CFLAGS) $(COMPILE) $(LINK)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(LINK)" > $@ + @echo "$(CFLAGS) $(COMPILE) $(HARDENING) $(LINK) $(HARDENING_LD)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(HARDENING) $(LINK) $(HARDENING_LD)" > $@ clean: rm -rf $(BINARIES) $(BINARIES:=.dSYM) $(BUILDSTAMP) *.o *~ src/*.o src/*~ -- cgit v1.3