mirror of
https://github.com/XRPLF/rippled.git
synced 2025-11-04 19:25:51 +00:00
build: add binary hardening compile and link flags (#4603)
Enhance security during the build process:
* The '-fstack-protector' flag enables stack protection for preventing
buffer overflow vulnerabilities. If an attempt is made to overflow the
buffer, the program will terminate, thus protecting the integrity of
the stack.
* The '-Wl,-z,relro,-z,now' linker flag enables Read-only Relocations
(RELRO), a feature that helps harden the binary against certain types
of exploits, particularly those that involve overwriting the Global
Offset Table (GOT).
* This flag is only set for Linux builds, due to compatibility issues
with apple-clang.
* The `relro` option makes certain sections of memory read-only after
initialization to prevent them from being overwritten, while `now`
ensures that all dynamic symbols are resolved immediately on program
start, reducing the window of opportunity for attacks.
This commit is contained in:
@@ -13,7 +13,6 @@ link_libraries (Ripple::common)
|
|||||||
set_target_properties (common
|
set_target_properties (common
|
||||||
PROPERTIES INTERFACE_POSITION_INDEPENDENT_CODE ON)
|
PROPERTIES INTERFACE_POSITION_INDEPENDENT_CODE ON)
|
||||||
set(CMAKE_CXX_EXTENSIONS OFF)
|
set(CMAKE_CXX_EXTENSIONS OFF)
|
||||||
target_compile_features (common INTERFACE cxx_std_17)
|
|
||||||
target_compile_definitions (common
|
target_compile_definitions (common
|
||||||
INTERFACE
|
INTERFACE
|
||||||
$<$<CONFIG:Debug>:DEBUG _DEBUG>
|
$<$<CONFIG:Debug>:DEBUG _DEBUG>
|
||||||
@@ -108,6 +107,7 @@ else ()
|
|||||||
-Wno-char-subscripts
|
-Wno-char-subscripts
|
||||||
-Wno-format
|
-Wno-format
|
||||||
-Wno-unused-local-typedefs
|
-Wno-unused-local-typedefs
|
||||||
|
-fstack-protector
|
||||||
$<$<BOOL:${is_gcc}>:
|
$<$<BOOL:${is_gcc}>:
|
||||||
-Wno-unused-but-set-variable
|
-Wno-unused-but-set-variable
|
||||||
-Wno-deprecated
|
-Wno-deprecated
|
||||||
@@ -120,6 +120,7 @@ else ()
|
|||||||
target_link_libraries (common
|
target_link_libraries (common
|
||||||
INTERFACE
|
INTERFACE
|
||||||
-rdynamic
|
-rdynamic
|
||||||
|
$<$<BOOL:${is_linux}>:-Wl,-z,relro,-z,now>
|
||||||
# link to static libc/c++ iff:
|
# link to static libc/c++ iff:
|
||||||
# * static option set and
|
# * static option set and
|
||||||
# * NOT APPLE (AppleClang does not support static libc/c++) and
|
# * NOT APPLE (AppleClang does not support static libc/c++) and
|
||||||
|
|||||||
Reference in New Issue
Block a user