diff options
| author | fanquake <[email protected]> | 2020-06-18 13:31:28 +0800 |
|---|---|---|
| committer | fanquake <[email protected]> | 2020-06-19 17:20:27 +0800 |
| commit | b536813cefc13f5c54a28a7c2fce8c69e89d6624 (patch) | |
| tree | 4242559791a76e7f3705618f8d985d28761a53c9 | |
| parent | build: add -fcf-protection=full to hardening options (diff) | |
| download | discoin-b536813cefc13f5c54a28a7c2fce8c69e89d6624.tar.xz discoin-b536813cefc13f5c54a28a7c2fce8c69e89d6624.zip | |
build: add -fstack-clash-protection to hardening flags
This option causes the compiler to insert probes whenever stack space
is allocated statically or dynamically to reliably detect stack overflows
and thus mitigate the attack vector that relies on jumping over a stack
guard page as provided by the operating system.
This option is now enabled by default in Ubuntu GCC as of 19.10.
Available in GCC 8 and Clang 11.
| -rw-r--r-- | configure.ac | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac index fe8ce1a8f..c26180ab3 100644 --- a/configure.ac +++ b/configure.ac @@ -786,6 +786,13 @@ if test x$use_hardening != xno; then AX_CHECK_COMPILE_FLAG([-fstack-protector-all],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fstack-protector-all"]) AX_CHECK_COMPILE_FLAG([-fcf-protection=full],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fcf-protection=full"]) + + dnl stack-clash-protection does not work properly when building for Windows. + dnl We use the test case from https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 + dnl to determine if it can be enabled. + AX_CHECK_COMPILE_FLAG([-fstack-clash-protection],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fstack-clash-protection"],[],["-O0"], + [AC_LANG_SOURCE([[class D {public: unsigned char buf[32768];}; int main() {D d; return 0;}]])]) + dnl When enable_debug is yes, all optimizations are disabled. dnl However, FORTIFY_SOURCE requires that there is some level of optimization, otherwise it does nothing and just creates a compiler warning. dnl Since FORTIFY_SOURCE is a no-op without optimizations, do not enable it when enable_debug is yes. |