diff options
| author | Florent Daigniere <nextgens@freenetproject.org> | 2012-03-15 10:02:30 +0000 |
|---|---|---|
| committer | Florent Daigniere <nextgens@freenetproject.org> | 2012-03-15 10:17:30 +0000 |
| commit | 62f3121a3d209fb4f826988d53b1aac93842502c (patch) | |
| tree | 38fd35b67d2a71ab3d4a54565863ed60215fe261 | |
| parent | 4ade55ecb9e6c3144dc6ed192fae0f613acfb467 (diff) | |
| download | tor-62f3121a3d209fb4f826988d53b1aac93842502c.tar.gz tor-62f3121a3d209fb4f826988d53b1aac93842502c.zip | |
fix for bug #5210: enable GCC and LD hardening by default
| -rw-r--r-- | changes/bug5210 | 2 | ||||
| -rw-r--r-- | configure.in | 12 |
2 files changed, 10 insertions, 4 deletions
diff --git a/changes/bug5210 b/changes/bug5210 new file mode 100644 index 0000000000..b07e7f1f23 --- /dev/null +++ b/changes/bug5210 @@ -0,0 +1,2 @@ + o Security fixes: + - Enable gcc and ld hardening by default. Fixes bug 5210. diff --git a/configure.in b/configure.in index 7415ce8312..4a3ed0e6c3 100644 --- a/configure.in +++ b/configure.in @@ -122,19 +122,23 @@ dnl -D_FORTIFY_SOURCE=2 -fstack-protector-all dnl Others suggest '/gs /safeseh /nxcompat /dynamicbase' for non-gcc on Windows dnl This requires that we use gcc and that we add -O2 to the CFLAGS. AC_ARG_ENABLE(gcc-hardening, - AS_HELP_STRING(--enable-gcc-hardening, enable compiler security checks), + AS_HELP_STRING(--disable-gcc-hardening, disable compiler security checks), + [], + [enableval=yes;]) [if test x$enableval = xyes; then CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all" CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector" CFLAGS="$CFLAGS --param ssp-buffer-size=1" LDFLAGS="$LDFLAGS -pie" -fi]) +fi] dnl Linker hardening options dnl Currently these options are ELF specific - you can't use this with MacOSX AC_ARG_ENABLE(linker-hardening, - AS_HELP_STRING(--enable-linker-hardening, enable linker security fixups), -[if test x$enableval = xyes; then + AS_HELP_STRING(--disable-linker-hardening, disable linker security fixups), + [], + [enableval=yes;]) +AC_CHECK_HEADER([elf.h], [if test x$enableval = xyes; then LDFLAGS="$LDFLAGS -z relro -z now" fi]) |