random

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>

configure.ac

@@ -32,7 +32,6 @@ AX_CHECK_LINK_FLAG([-Wl,--enable-new-dtags],
 		   [AC_MSG_ERROR(["Linker support for --enable-new-dtags is required"])])
 AX_CHECK_LINK_FLAG([-Wl,--as-needed], [AM_LDFLAGS="$AM_LDFLAGS -Wl,--as-needed"])
 
-AC_SUBST([AM_LDFLAGS])
 saved_LDFLAGS="$LDFLAGS"
 LDFLAGS="$AM_LDFLAGS $LDFLAGS"
 LT_INIT
@@ -319,14 +318,30 @@ AC_ARG_WITH([testdir],
 AC_SUBST([TESTDIR])
 
 # Check for availablility of hardening options
-HARDENING_CFLAGS="-fstack-clash-protection"
+
+if echo $CC | grep -q gcc; then
+	ANNOPLUGIN="-fplugin=annobin"
+fi
+
+HARDENING_CFLAGS_ANNOCHECK="$ANNOPLUGIN -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fexceptions -D_GLIBCXX_ASSERTIONS"
+HARDENING_CFLAGS="-fstack-clash-protection -fcf-protection=full -mcet -mstackrealign"
 EXTRA_HARDENING_CFLAGS=""
 if test "x${enable_hardening}" = xyes; then
+	annocheck=yes
+	for j in $HARDENING_CFLAGS_ANNOCHECK; do
+		if cc_supports_flag $j; then
+			EXTRA_HARDENING_CFLAGS="$EXTRA_HARDENING_CFLAGS $j"
+		else
+			annocheck=no
+		fi
+	done
 	for j in $HARDENING_CFLAGS; do
 		if cc_supports_flag $j; then
-			EXTRA_HARDENING_CFLAGS="$EXTRA_HARDENING_CFLAGS $j";
+			EXTRA_HARDENING_CFLAGS="$EXTRA_HARDENING_CFLAGS $j"
 		fi
 	done
+	EXTRA_HARDENING_CFLAGS="$pic_flag $EXTRA_HARDENING_CFLAGS"
+	AM_LDFLAGS="$pic_flag $AM_LDFLAGS $EXTRA_HARDENING_CFLAGS"
 fi
 
 # debug build stuff
@@ -382,6 +397,7 @@ UNWANTED_CFLAGS="-Wno-unused-parameter"
 
 AC_SUBST([AM_CFLAGS],["$SANITIZERS_CFLAGS $OPT_CFLAGS $GDB_CFLAGS $DEFAULT_CFLAGS $EXTRA_HARDENING_CFLAGS $UNWANTED_CFLAGS"])
 LDFLAGS="$SANITIZERS_LDFLAGS $LDFLAGS"
+AC_SUBST([AM_LDFLAGS])
 
 AX_PROG_DATE
 AS_IF([test "$ax_cv_prog_date_gnu_date:$ax_cv_prog_date_gnu_utc" = yes:yes],