Re: [PATCH] use -pie in CFLAGS

2008-01-23 16:00:30 Olaf Hering napisał(a):
> Security people like -fpie compiler option.
> I came up with this change. Its used since August 2005.
>
> Makefile.in | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
> --- a/Makefile.in
> +++ b/Makefile.in
> @@ -150,24 +150,27 @@ CXXFLAGS = @CXXFLAGS@ $(EXTRA_CXXFLAGS)
> CPPFLAGS = @CPPFLAGS@ $(EXTRA_CPPFLAGS)
> LDFLAGS = @LDFLAGS@ $(EXTRA_LDFLAGS)
>
> +NOPIECFLAGS = -fno-pie -fno-PIE
> +PIECFLAGS = -fpie -fPIE
> +PIELDFLAGS = -pie
> COMPILE = $(CC) $(CPPFLAGS) $(CFLAGS) $(INCLUDES)
> COMPILE_CXX = $(CXX) $(CPPFLAGS) $(CXXFLAGS) $(INCLUDES)
> -LT_COMPILE = $(LIBTOOL) $(LTFLAGS) --mode=compile $(COMPILE)
> +LT_COMPILE = $(LIBTOOL) $(LTFLAGS) --mode=compile $(COMPILE) $(NOPIECFLAGS)
>
> # special compilation for files destined for mod_dav_svn
> -COMPILE_APACHE_MOD = $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) $(APACHE_INCLUDES) $(INCLUDES) -o $@ -c
> +COMPILE_APACHE_MOD = $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) $(NOPIECFLAGS) $(APACHE_INCLUDES) $(INCLUDES) -o $@ -c
>
> # special compilation for files destined for libsvn_swig_* (e.g. swigutil_*.c)
> -COMPILE_SWIG_PY = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_PY_COMPILE) $(CPPFLAGS) -DSWIGPYTHON $(CFLAGS) $(SWIG_PY_INCLUDES) $(INCLUDES) -o $@ -c
> -COMPILE_SWIG_PL = $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) $(SWIG_PL_INCLUDES) $(INCLUDES) -o $@ -c
> -COMPILE_SWIG_RB = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_RB_COMPILE) $(CPPFLAGS) $(CFLAGS) $(SWIG_RB_INCLUDES) $(INCLUDES) -o $@ -c
> +COMPILE_SWIG_PY = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_PY_COMPILE) $(CPPFLAGS) -DSWIGPYTHON $(CFLAGS) $(NOPIECFLAGS) $(SWIG_PY_INCLUDES) $(INCLUDES) -o $@ -c
> +COMPILE_SWIG_PL = $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) $(NOPIECFLAGS) $(SWIG_PL_INCLUDES) $(INCLUDES) -o $@ -c
> +COMPILE_SWIG_RB = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_RB_COMPILE) $(CPPFLAGS) $(CFLAGS) $(NOPIECFLAGS) $(SWIG_RB_INCLUDES) $(INCLUDES) -o $@ -c
>
> # special compilation for files destined for javahl (i.e. C++)
> -COMPILE_JAVAHL_CXX = $(LIBTOOL) $(LTCXXFLAGS) --mode=compile $(COMPILE_CXX) $(JAVAHL_INCLUDES) -o $@ -c
> +COMPILE_JAVAHL_CXX = $(LIBTOOL) $(LTCXXFLAGS) --mode=compile $(COMPILE_CXX) $(NOPIECFLAGS) $(JAVAHL_INCLUDES) -o $@ -c
> COMPILE_JAVAHL_JAVAC = $(JAVAC) $(JAVAC_FLAGS)
> COMPILE_JAVAHL_JAVAH = $(JAVAH)
>
> -LINK = $(LIBTOOL) $(LTFLAGS) --mode=link $(CC) $(LT_LDFLAGS) $(CFLAGS) $(LDFLAGS) -rpath $(libdir)
> +LINK = $(LIBTOOL) $(LTFLAGS) --mode=link $(CC) $(LT_LDFLAGS) $(CFLAGS) $(LDFLAGS) $(PIELDFLAGS) -rpath $(libdir)
>
> # special link rule for mod_dav_svn
> LINK_APACHE_MOD = $(LIBTOOL) $(LTFLAGS) --mode=link $(CC) $(LT_LDFLAGS) $(CFLAGS) $(LDFLAGS) -rpath $(APACHE_LIBEXECDIR) -avoid-version -module $(APACHE_LDFLAGS)
>

Are you sure that -fpie etc. are supported by all compilers?

-- 
Arfrever Frehtes Taifersar Arahesis