Makefile: Add build hardening with -fPIE flag#775
Conversation
ef33c19 to
561a912
Compare
|
qa-passed |
|
Seems like the build with clang is failing and needs to be looked at. |
|
@dlespiau yes I have noticed clang build is not passing. It is due to following warnings considered as errors: Any idea how to properly solve this ? |
|
We can always adapt the flags depending on the compiler we configure the compilation with (CC=gcc or CC=clang). |
|
Yes makes sense. Supposed to do that from configure.ac ? |
|
Yes, configure.ac. Test CC in configure.ac, set a variable, eg. PIE_CFLAGS, to either |
|
@dlespiau I think I have just figured this out. No need to make a check according to the compiler used because clang actually support -pie link option. The warning/error message was about wrong use of -pie which is a link option as a compiler option. |
Adding the -fPIE -pie flags in order to harden the security. It creates our binary as a Position Independant Executable, and takes advantage of ASLR, making ROP attacks much harder to perform. See https://wiki.debian.org/Hardening for further details. Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
561a912 to
7815d4f
Compare
|
@dlespiau build is passing now ;) |
|
qa-passed |
|
@grahamwhaley @dlespiau maybe LGTM this one ? |
|
Yep, given the qa-passed and CI passed, and we are pretty sure about the -pie being a linker only cmd, |
|
I've checked locally and the resulting binaries seem to be relocatable and ready for ASLR. lgtm. |
|
lgtm? (maybe editing doesn't trigger pullaprove?) |
Adding the -fPIE -pie flags in order to harden the security. It creates our binary as a Position Independant Executable, and takes advantage of ASLR, making ROP attacks much harder to perform.
See https://wiki.debian.org/Hardening for further details.