diff options
Diffstat (limited to 'debian/patches/500-buildflags.patch')
| -rw-r--r-- | debian/patches/500-buildflags.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/debian/patches/500-buildflags.patch b/debian/patches/500-buildflags.patch new file mode 100644 index 0000000..46cf411 --- /dev/null +++ b/debian/patches/500-buildflags.patch @@ -0,0 +1,33 @@ +Description: Poke requested Debian buildflags for hardening into Makefile +Author: Jörg Frings-Fürst <debian@jff-webhosting.net> +Last-Update: 2015-01-07 +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +Index: trunk/Makefile +=================================================================== +--- trunk.orig/Makefile ++++ trunk/Makefile +@@ -394,10 +394,11 @@ VALA_CFLAGS := `pkg-config --cflags $(EX + $(foreach def,$(DEFINES),-D$(def)) + + VALA_LDFLAGS := `pkg-config --libs $(EXT_PKGS) $(DIRECT_LIBS) gthread-2.0` ++VALA_LDFLAGS += -fPIE -pie -Wl,-z,relro -Wl,-z,now + + # REQUIRED_CFLAGS absolutely get appended to CFLAGS, whatever the + # the value of CFLAGS in the environment +-REQUIRED_CFLAGS := -fPIC ++REQUIRED_CFLAGS := -g -O2 -fPIE -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 + + # setting CFLAGS in configure.mk overrides build type + ifndef CFLAGS +@@ -410,8 +411,8 @@ PLUGIN_CFLAGS = -O2 -g -pipe + endif + endif + +-CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) +-PLUGIN_CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) ++CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) -fstack-protector-strong ++PLUGIN_CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) -fPIC -fno-stack-protector + + # Required for gudev-1.0 + CFLAGS += -DG_UDEV_API_IS_SUBJECT_TO_CHANGE |