From 99a706ded2a79768ce5b850be0d4262d321aa296 Mon Sep 17 00:00:00 2001
From: Dirk Engling <erdgeist@erdgeist.org>
Date: Fri, 6 Nov 2026 19:03:30 +0100
Subject: Add hardening parameters to the default builds

---
 Makefile | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'Makefile')

diff --git a/Makefile b/Makefile
index 2b8ad92..eed77a0 100644
--- a/Makefile
+++ b/Makefile
@@ -43,6 +43,12 @@ include Mk/gzip.mk
 CFLAGS?=-O3
 
 OT_CFLAGS+=-Wall -Wextra -Wwrite-strings -pipe -pthread
+
+HARDENING=-fstack-protector-strong -fPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
+HARDENING_LD=-pie
+# Full RELRO is free at runtime and makes the GOT read-only, but Apple's linker
+# does not accept -z, so enable it for the GNU-style linkers (Linux, the BSDs):
+#HARDENING_LD+=-Wl,-z,relro,-z,now
 OT_LDFLAGS+=-pthread
 
 OPTS_debug=-D_DEBUG -g -ggdb
@@ -65,11 +71,11 @@ BUILDDEPS=Makefile $(BUILDSTAMP)
 all: $(BINARY) $(BINARY).debug
 
 $(BINARY): $(SOURCES) $(HEADERS) $(BUILDDEPS)
-	$(CC) -o $@ $(CFLAGS) $(COMPILE) $(SOURCES) $(LINK)
+	$(CC) -o $@ $(CFLAGS) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD)
 	$(STRIP) $@
 
 $(BINARY).debug: $(SOURCES) $(HEADERS) $(BUILDDEPS)
-	$(CC) -o $@ $(OPTS_debug) $(COMPILE) $(SOURCES) $(LINK)
+	$(CC) -o $@ $(OPTS_debug) $(COMPILE) $(HARDENING) $(SOURCES) $(LINK) $(HARDENING_LD)
 
 $(BUILDSTAMP): FORCE
 	@echo "$(CFLAGS) $(COMPILE) $(LINK)" | cmp -s - $@ 2>/dev/null || echo "$(CFLAGS) $(COMPILE) $(LINK)" > $@
-- 
cgit v1.3