Re: Enabling hardening flags for HIP libraries
On 2023-03-04 05:31, M. Zhou wrote:
> The eventual result of hardening=xxx is additional CXXFLAGS/CPPFLAGS/LDFLAGS.
> You may lookup dpkg-buildflags(1) man page for details.
>
> I did not manage to recall an elegant way to dump these flags, but you may
> copy the actual compiler flags from the man page and manually add them
> to {CXX,CPP,LD} flags as a temporary workaround.
>
> Maybe someone else has a better idea.
src:libcap2 builds both executables and libraries, and hardening=+all
adding -fPIE to CFLAGS interfered with the library build, so I patched
upstream's Makefile [1] to filter out those flags where necessary.
The solution of using -X seems like the "correct" way to do it, but I'm
not sure how this could be implemented. Like Mo says above,
hardening=xxx just modifies a couple of standard variables.
[1] https://sources.debian.org/src/libcap2/1%3A2.66-3/debian/patches/Filter-out-PIE-flags-when-building-shared-objects.patch/
Best,
Christian
Reply to: