Add some hardening compiler / linker flags.

desktop-app · Sep 28, 2021 · f3a611c · f3a611c
1 parent 1dacc0a
commit f3a611c
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 1 deletion.
diff --git a/external/jemalloc/CMakeLists.txt b/external/jemalloc/CMakeLists.txt
@@ -33,7 +33,7 @@ if (NOT JEMALLOC_FOUND)
     include(ExternalProject)
     ExternalProject_Add(jemalloc
         SOURCE_DIR ${jemalloc_loc}
-        CONFIGURE_COMMAND cd "${jemalloc_loc}" && CC=clang CXX=clang++ EXTRA_CFLAGS=-fPIE EXTRA_CXXFLAGS=-fPIE ./autogen.sh
+        CONFIGURE_COMMAND cd "${jemalloc_loc}" && export EXTRA_CFLAGS=-fstack-protector-all\ -fPIC\ -D_FORTIFY_SOURCE=2 && export EXTRA_CXXFLAGS=-fstack-protector-all\ -fPIC\ -D_FORTIFY_SOURCE=2 && CC=clang CXX=clang++ ./autogen.sh
         INSTALL_COMMAND :
         BUILD_IN_SOURCE 1
         BUILD_BYPRODUCTS ${jemalloc_loc}/lib/libjemalloc.a

diff --git a/linux_glib_helper/CMakeLists.txt b/linux_glib_helper/CMakeLists.txt
@@ -5,6 +5,7 @@
 # https://github.com/desktop-app/legal/blob/master/LEGAL
 
 add_library(linux_glib_helper STATIC)
+init_target(linux_glib_helper "(external)")
 add_library(desktop-app::linux_glib_helper ALIAS linux_glib_helper)
 
 nice_target_sources(linux_glib_helper ${CMAKE_CURRENT_SOURCE_DIR}

diff --git a/linux_gtk_helper/CMakeLists.txt b/linux_gtk_helper/CMakeLists.txt
@@ -5,6 +5,7 @@
 # https://github.com/desktop-app/legal/blob/master/LEGAL
 
 add_library(linux_gtk_helper STATIC)
+init_target(linux_gtk_helper "(external)")
 add_library(desktop-app::linux_gtk_helper ALIAS linux_gtk_helper)
 
 nice_target_sources(linux_gtk_helper ${CMAKE_CURRENT_SOURCE_DIR}

diff --git a/linux_wayland_helper/CMakeLists.txt b/linux_wayland_helper/CMakeLists.txt
@@ -5,6 +5,7 @@
 # https://github.com/desktop-app/legal/blob/master/LEGAL
 
 add_library(linux_wayland_helper STATIC)
+init_target(linux_wayland_helper "(external)")
 add_library(desktop-app::linux_wayland_helper ALIAS linux_wayland_helper)
 
 nice_target_sources(linux_wayland_helper ${CMAKE_CURRENT_SOURCE_DIR}

diff --git a/options_linux.cmake b/options_linux.cmake
@@ -6,6 +6,8 @@
 
 target_compile_options(common_options
 INTERFACE
+    -fstack-protector-all
+    -fstack-clash-protection
     -fPIC
     $<IF:$<CONFIG:Debug>,,-fno-strict-aliasing>
     -pipe
@@ -17,9 +19,17 @@ INTERFACE
     -Wno-sign-compare
 )
 
+target_compile_definitions(common_options
+INTERFACE
+    $<IF:$<CONFIG:Debug>,,_FORTIFY_SOURCE=2>
+)
+
 target_link_options(common_options
 INTERFACE
     -Wl,--as-needed
+    -Wl,-z,relro
+    -Wl,-z,now
+    -pie
 )
 
 if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU")