diff --git a/CMakeLists.txt b/CMakeLists.txt index e4560031c882..823f1aa0568e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -233,7 +233,11 @@ endif(NOT "${CMAKE_CXX_FLAGS}" STREQUAL "${COMPILER_FLAGS}") if(HARDEN) set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIE -fstack-protector-strong") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fPIE -fstack-protector-strong") - set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fPIE -pie -Wl,-z,now,-z,relro") + if(NOT APPLE) + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fPIE -pie -Wl,-z,now,-z,relro") + else(NOT APPLE) + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fPIE -Wl,-pie") + endif(NOT APPLE) add_definitions(-D_FORTIFY_SOURCE=2) endif(HARDEN) diff --git a/SConstruct b/SConstruct index d83b04a9ba53..01953293631c 100755 --- a/SConstruct +++ b/SConstruct @@ -483,15 +483,20 @@ for env in [test_env, client_env, env]: # # # Add options to provide more hardened executables +# osx doesn't seem to support RELRO # # if env['harden']: env.AppendUnique(CCFLAGS = ["-fPIE", "-fstack-protector-strong"]) - env.AppendUnique(LINKFLAGS = ["-fPIE", "-pie", "-Wl,-z,now,-z,relro"]) env.AppendUnique(CPPDEFINES = ["_FORTIFY_SOURCE=2"]) if env["enable_lto"] == True: env.AppendUnique(LINKFLAGS = ["-fstack-protector-strong"]) + + if env["PLATFORM"] == 'darwin': + env.AppendUnique(LINKFLAGS = ["-fPIE", "-Wl,-pie"]) + else: + env.AppendUnique(LINKFLAGS = ["-fPIE", "-pie", "-Wl,-z,relro,-z,now"]) # # # Start determining options for debug build