From 7792b7117bda76873ad8c5339d7441191c132703 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Fri, 6 Nov 2026 20:30:27 +0100 Subject: take -pie out of macos hardening build flags --- DESIGN | 19 +++++++++++-------- Makefile | 5 +---- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/DESIGN b/DESIGN index b25b37c..39d0107 100644 --- a/DESIGN +++ b/DESIGN @@ -115,20 +115,23 @@ which costs it part of its last day and nothing else. Build hardening the shipped binary ---------------------------------- -The production and debug binaries carry -fstack-protector-strong, PIE and -_FORTIFY_SOURCE=2; every linker but Apple's also gets full RELRO (-z relro,-z now). Measured cost on +The production and debug binaries carry -fstack-protector-strong, -fPIE and +_FORTIFY_SOURCE=2 on every platform; the GNU-style linkers also get -pie and +full RELRO (-z relro,-z now). Measured cost on the announce hot path is 300 to 305 nanoseconds, under two per cent, and the individual flags sit inside the run-to-run noise: add_peer has few stack buffers, most buffer sizes are known at compile time so FORTIFY emits no runtime check, and PIE on arm64 is almost free. On x86-64 PIE costs a little more. End to end it is invisible, since a UDP announce is mostly kernel time. -RELRO is gated on the operating system because Apple's linker rejects -z. The -branch runs in the shell through a != assignment, the one form both bmake and -GNU make 4 accept; $(shell) is GNU only and GNU make 3.81, which stock macOS -ships, has neither. On that old make the != line is inert and leaves RELRO -empty, which is the right answer for macOS anyway, so every platform resolves -correctly without a make conditional. +The link flags -pie and RELRO are gated on the operating system: Apple's +linker rejects -z, and flags a bare -pie in the combined compile-and-link as +unused, while macOS links executables PIE by default, so leaving both off +there costs no hardening. The branch runs in the shell through a != assignment, +the one form both bmake and GNU make 4 accept; $(shell) is GNU only and GNU +make 3.81, which stock macOS ships, has neither. On that old make the != line +is inert and leaves the flags empty, which is the right answer for macOS +anyway, so every platform resolves correctly without a make conditional. The flags are not in OT_CFLAGS, so the sanitizer test builds do not inherit them. AddressSanitizer checks harder than FORTIFY does, and the two clash on diff --git a/Makefile b/Makefile index 7ed552c..15828bb 100644 --- a/Makefile +++ b/Makefile @@ -45,10 +45,7 @@ CFLAGS?=-O3 OT_CFLAGS+=-Wall -Wextra -Wwrite-strings -pipe -pthread HARDENING=-fstack-protector-strong -fPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -HARDENING_LD=-pie -# Full RELRO on every linker that takes it, which is all but Apple's. See DESIGN. -RELRO_LD!= case `uname -s` in Darwin) ;; *) printf %s -Wl,-z,relro,-z,now ;; esac -HARDENING_LD+=$(RELRO_LD) +HARDENING_LD!= case `uname -s` in Darwin) ;; *) printf %s "-pie -Wl,-z,relro,-z,now" ;; esac OT_LDFLAGS+=-pthread OPTS_debug=-D_DEBUG -g -ggdb -- cgit v1.3