build: add binary hardening compile and link flags (#4603)

Enhance security during the build process:

* The '-fstack-protector' flag enables stack protection for preventing
  buffer overflow vulnerabilities. If an attempt is made to overflow the
  buffer, the program will terminate, thus protecting the integrity of
  the stack.
* The '-Wl,-z,relro,-z,now' linker flag enables Read-only Relocations
  (RELRO), a feature that helps harden the binary against certain types
  of exploits, particularly those that involve overwriting the Global
  Offset Table (GOT).
  * This flag is only set for Linux builds, due to compatibility issues
    with apple-clang.
  * The `relro` option makes certain sections of memory read-only after
    initialization to prevent them from being overwritten, while `now`
    ensures that all dynamic symbols are resolved immediately on program
    start, reducing the window of opportunity for attacks.
This commit is contained in:
John Freeman
2023-07-03 09:41:12 -05:00
committed by GitHub
parent 9c50415ebe
commit 66bfe909e6

View File

@@ -13,7 +13,6 @@ link_libraries (Ripple::common)
set_target_properties (common set_target_properties (common
PROPERTIES INTERFACE_POSITION_INDEPENDENT_CODE ON) PROPERTIES INTERFACE_POSITION_INDEPENDENT_CODE ON)
set(CMAKE_CXX_EXTENSIONS OFF) set(CMAKE_CXX_EXTENSIONS OFF)
target_compile_features (common INTERFACE cxx_std_17)
target_compile_definitions (common target_compile_definitions (common
INTERFACE INTERFACE
$<$<CONFIG:Debug>:DEBUG _DEBUG> $<$<CONFIG:Debug>:DEBUG _DEBUG>
@@ -108,6 +107,7 @@ else ()
-Wno-char-subscripts -Wno-char-subscripts
-Wno-format -Wno-format
-Wno-unused-local-typedefs -Wno-unused-local-typedefs
-fstack-protector
$<$<BOOL:${is_gcc}>: $<$<BOOL:${is_gcc}>:
-Wno-unused-but-set-variable -Wno-unused-but-set-variable
-Wno-deprecated -Wno-deprecated
@@ -120,6 +120,7 @@ else ()
target_link_libraries (common target_link_libraries (common
INTERFACE INTERFACE
-rdynamic -rdynamic
$<$<BOOL:${is_linux}>:-Wl,-z,relro,-z,now>
# link to static libc/c++ iff: # link to static libc/c++ iff:
# * static option set and # * static option set and
# * NOT APPLE (AppleClang does not support static libc/c++) and # * NOT APPLE (AppleClang does not support static libc/c++) and