From 4a01fea4a96374a1359d43a280a236a3ea042a1c Mon Sep 17 00:00:00 2001
From: Dirk Engling <erdgeist@erdgeist.org>
Date: Fri, 6 Nov 2026 19:09:43 +0100
Subject: Enable RELRO everywhere than macos

---
 Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'Makefile')

diff --git a/Makefile b/Makefile
index eed77a0..7ed552c 100644
--- a/Makefile
+++ b/Makefile
@@ -46,9 +46,9 @@ OT_CFLAGS+=-Wall -Wextra -Wwrite-strings -pipe -pthread
 
 HARDENING=-fstack-protector-strong -fPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
 HARDENING_LD=-pie
-# Full RELRO is free at runtime and makes the GOT read-only, but Apple's linker
-# does not accept -z, so enable it for the GNU-style linkers (Linux, the BSDs):
-#HARDENING_LD+=-Wl,-z,relro,-z,now
+# Full RELRO on every linker that takes it, which is all but Apple's. See DESIGN.
+RELRO_LD!=	case `uname -s` in Darwin) ;; *) printf %s -Wl,-z,relro,-z,now ;; esac
+HARDENING_LD+=$(RELRO_LD)
 OT_LDFLAGS+=-pthread
 
 OPTS_debug=-D_DEBUG -g -ggdb
@@ -78,7 +78,7 @@ $(BINARY).debug: $(SOURCES) $(HEADERS) $(BUILDDEPS)
 	$(CC) -o $@ $(OPTS_debug) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD)
 
 $(BUILDSTAMP): FORCE
-	@echo "$(CFLAGS) $(COMPILE) $(LINK)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(LINK)" > $@
+	@echo "$(CFLAGS) $(COMPILE) $(HARDENING) $(LINK) $(HARDENING_LD)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(HARDENING) $(LINK) $(HARDENING_LD)" > $@
 
 clean:
 	rm -rf $(BINARIES) $(BINARIES:=.dSYM) $(BUILDSTAMP) *.o *~ src/*.o src/*~
-- 
cgit v1.3