a6c072343a
Where available, enable stack smashing protection, fortify source, no-strict-overflow, and read only relocations. Many Linux distributions automatically enable most of these options. They are no brainers. The difference introduced here is in asking for a few more aggressive options. An option to disable the more aggressive options is provided (--disable-hardening). When set, configure will fall back to the default CFLAGS on the system - in many cases that will still be hardened. There is no point in going further than that. Options enabled are: -fstack-protector-strong is a relatively new GCC-4.9 feature that is supposed to give a better balance between performance and protection. -all is considered too aggressive, but was used in Chromium and other security critical systems until -strong became available. Follow their lead and use -strong when possible. clang 6.0 supports -all but not -strong. _FORTIFY_SOURCE replaces certain unsafe C str* and mem* functions with more robust equivalents when the compiler can determine the length of the buffers involved. -fno-strict-overflow instructs GCC to not make optimizations based on the assumption that signed arithmetic will wrap around on overflow (e.g. (short)0x7FFF + 1 == 0). This prevents the optimizer from doing some unexpected things. Further improvements should trap signed overflows and reduce the use of signed to refer to naturally unsigned quantities. I did not set -fPIE (position independent executables). The critical function of Open/LibreSSL is as a library, not an executable. Tested on Ubuntu Linux 14.04.1 LTS, OS X 10.10.1 with "make check". Signed-off-by: Jim Barlow <jim@purplerock.ca>
74 lines
3.1 KiB
Plaintext
74 lines
3.1 KiB
Plaintext
# ===========================================================================
|
|
# http://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
|
|
# ===========================================================================
|
|
#
|
|
# SYNOPSIS
|
|
#
|
|
# AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT])
|
|
#
|
|
# DESCRIPTION
|
|
#
|
|
# Check whether the given FLAG works with the linker or gives an error.
|
|
# (Warnings, however, are ignored)
|
|
#
|
|
# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
|
|
# success/failure.
|
|
#
|
|
# If EXTRA-FLAGS is defined, it is added to the linker's default flags
|
|
# when the check is done. The check is thus made with the flags: "LDFLAGS
|
|
# EXTRA-FLAGS FLAG". This can for example be used to force the linker to
|
|
# issue an error when a bad flag is given.
|
|
#
|
|
# INPUT gives an alternative input source to AC_LINK_IFELSE.
|
|
#
|
|
# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
|
|
# macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG.
|
|
#
|
|
# LICENSE
|
|
#
|
|
# Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
|
|
# Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by the
|
|
# Free Software Foundation, either version 3 of the License, or (at your
|
|
# option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
|
|
# Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License along
|
|
# with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
# As a special exception, the respective Autoconf Macro's copyright owner
|
|
# gives unlimited permission to copy, distribute and modify the configure
|
|
# scripts that are the output of Autoconf when processing the Macro. You
|
|
# need not follow the terms of the GNU General Public License when using
|
|
# or distributing such scripts, even though portions of the text of the
|
|
# Macro appear in them. The GNU General Public License (GPL) does govern
|
|
# all other use of the material that constitutes the Autoconf Macro.
|
|
#
|
|
# This special exception to the GPL applies to versions of the Autoconf
|
|
# Macro released by the Autoconf Archive. When you make and distribute a
|
|
# modified version of the Autoconf Macro, you may extend this special
|
|
# exception to the GPL to apply to your modified version as well.
|
|
|
|
#serial 3
|
|
|
|
AC_DEFUN([AX_CHECK_LINK_FLAG],
|
|
[AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
|
|
AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
|
|
ax_check_save_flags=$LDFLAGS
|
|
LDFLAGS="$LDFLAGS $4 $1"
|
|
AC_LINK_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])],
|
|
[AS_VAR_SET(CACHEVAR,[yes])],
|
|
[AS_VAR_SET(CACHEVAR,[no])])
|
|
LDFLAGS=$ax_check_save_flags])
|
|
AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
|
|
[m4_default([$2], :)],
|
|
[m4_default([$3], :)])
|
|
AS_VAR_POPDEF([CACHEVAR])dnl
|
|
])dnl AX_CHECK_LINK_FLAGS
|