Description: Poke requested Debian buildflags for hardening into Makefile Author: Jörg Frings-Fürst Last-Update: 2015-01-07 --- This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ Index: trunk/Makefile =================================================================== --- trunk.orig/Makefile +++ trunk/Makefile @@ -394,10 +394,11 @@ VALA_CFLAGS := `pkg-config --cflags $(EX $(foreach def,$(DEFINES),-D$(def)) VALA_LDFLAGS := `pkg-config --libs $(EXT_PKGS) $(DIRECT_LIBS) gthread-2.0` +VALA_LDFLAGS += -fPIE -pie -Wl,-z,relro -Wl,-z,now # REQUIRED_CFLAGS absolutely get appended to CFLAGS, whatever the # the value of CFLAGS in the environment -REQUIRED_CFLAGS := -fPIC +REQUIRED_CFLAGS := -g -O2 -fPIE -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 # setting CFLAGS in configure.mk overrides build type ifndef CFLAGS @@ -410,8 +411,8 @@ PLUGIN_CFLAGS = -O2 -g -pipe endif endif -CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) -PLUGIN_CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) +CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) -fstack-protector-strong +PLUGIN_CFLAGS += $(PROFILE_FLAGS) $(REQUIRED_CFLAGS) -fPIC -fno-stack-protector # Required for gudev-1.0 CFLAGS += -DG_UDEV_API_IS_SUBJECT_TO_CHANGE