59 lines
2.0 KiB
Plaintext
59 lines
2.0 KiB
Plaintext
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
|
|
hardeningFlags+=("${hardeningEnable[@]}")
|
|
hardeningCFlags=()
|
|
hardeningLDFlags=()
|
|
hardeningDisable=(${hardeningDisable[@]})
|
|
|
|
if [[ "$($LD -z 2>&1)" =~ "unknown option" ]]; then
|
|
hardeningDisable+=(bindnow relro)
|
|
fi
|
|
|
|
if [[ ! $hardeningDisable == "all" ]]; then
|
|
for flag in "${hardeningFlags[@]}"
|
|
do
|
|
if [[ ! "${hardeningDisable[@]}" =~ "$flag" ]]; then
|
|
case $flag in
|
|
fortify)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling fortify; fi
|
|
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
|
|
;;
|
|
stackprotector)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling stackprotector; fi
|
|
hardeningCFlags+=('-fstack-protector-strong' '--param ssp-buffer-size=4')
|
|
;;
|
|
pie)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling CFlags -fPIE; fi
|
|
hardeningCFlags+=('-fPIE')
|
|
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling LDFlags -pie; fi
|
|
hardeningLDFlags+=('-pie')
|
|
fi
|
|
;;
|
|
pic)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling pic; fi
|
|
hardeningCFlags+=('-fPIC')
|
|
;;
|
|
strictoverflow)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling strictoverflow; fi
|
|
hardeningCFlags+=('-fno-strict-overflow')
|
|
;;
|
|
format)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling format; fi
|
|
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
|
|
;;
|
|
relro)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling relro; fi
|
|
hardeningLDFlags+=('-z relro')
|
|
;;
|
|
bindnow)
|
|
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling bindnow; fi
|
|
hardeningLDFlags+=('-z now')
|
|
;;
|
|
*)
|
|
echo "Hardening flag unknown: $flag"
|
|
;;
|
|
esac
|
|
fi
|
|
done
|
|
fi
|