snailed
/
void-packages
2
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Activity

xbps-src: move compiler/linker defaults to env/hardening.sh. 

The user can still set his/her defaults via etc/conf, and per
package in the templates.
This commit is contained in:
Juan RP 2015-11-17 17:13:12 +01:00
parent 8257e5cdba
commit 784f75931d
5 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
common/environment/build/build-pie.sh
View File

@ -1 +0,0 @@
../configure/build-pie.sh

1
common/environment/build/hardening.sh Symbolic link
View File

@ -0,0 +1 @@
../configure/hardening.sh

8
common/environment/configure/build-pie.sh
View File

@ -1,8 +0,0 @@
_GCCSPECSDIR=${XBPS_COMMONDIR}/environment/configure/gccspecs
if [ -z "$nopie" ]; then
CFLAGS+=" -specs=$_GCCSPECSDIR/hardened-cc1"
CXXFLAGS+=" -specs=$_GCCSPECSDIR/hardened-cc1"
# We pass -z relro -z now here too, because libtool drops -specs...
LDFLAGS+=" -specs=$_GCCSPECSDIR/hardened-ld -Wl,-z,relro -Wl,-z,now"
fi

13
common/environment/configure/hardening.sh Normal file
View File

@ -0,0 +1,13 @@
# Enable SSP and FORITFY_SOURCE=2 by default.
XBPS_CFLAGS+=" -fstack-protector-strong -D_FORTIFY_SOURCE=2"
XBPS_CXXFLAGS+=" ${XBPS_CFLAGS}"
# Enable as-needed and relro by default.
XBPS_LDFLAGS+=" -Wl,--as-needed -Wl,-z,relro"
if [ -z "$nopie" ]; then
_GCCSPECSDIR=${XBPS_COMMONDIR}/environment/configure/gccspecs
XBPS_CFLAGS+=" -specs=${_GCCSPECSDIR}/hardened-cc1"
XBPS_CXXFLAGS+=" -specs=${_GCCSPECSDIR}/hardened-cc1"
# We pass -z relro -z now here too, because libtool drops -specs...
XBPS_LDFLAGS+=" -specs=${_GCCSPECSDIR}/hardened-ld -Wl,-z,relro -Wl,-z,now"
fi

8
etc/defaults.conf
View File

@ -23,15 +23,13 @@ XBPS_INSTALL_ARGS="--repository=http://repo.voidlinux.eu/current --repository=ht
# Native Compilation/Preprocessor flags for C and C++. Additional settings
# for the target architecture are also declared in common/build-profiles/<arch>.sh.
#
XBPS_CFLAGS="-O2 -pipe -fstack-protector-strong -D_FORTIFY_SOURCE=2"
XBPS_CFLAGS="-O2 -pipe"
XBPS_CXXFLAGS="${XBPS_CFLAGS}"
# [OPTIONAL]
# Linker flags passed to the compiler. By default we use --as-needed to
# avoid linking extra libraries into binaries. See the following link
# for info: http://www.gentoo.org/proj/en/qa/asneeded.xml
# Linker flags passed to the compiler.
#
XBPS_LDFLAGS="-Wl,--as-needed -Wl,-z,relro"
#XBPS_LDFLAGS=""
# [REQUIRED]
# Command to execute to gain root privileges when using the `update-sys`