aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorfanquake <fanquake@gmail.com>2019-12-06 15:34:39 -0500
committerfanquake <fanquake@gmail.com>2019-12-13 09:33:20 -0500
commitc78b123982d59fe2d633659f23d6893de627f3f6 (patch)
tree1dde3a95fe7205e43db726a675b90ffddc21cfed
parent988fe5b1adc0cb551dfacd7d3eedf4bd7edc918a (diff)
build: add -bind_at_load to hardened LDFLAGS
This performs the same function as -Wl,-z,now, except for ld on macOS. You can check the binaries using otool -l, looking for the LC_DYLD_INFO_ONLY section. lazy_bind_off and lazy_bind_size should both be 0. man ld: -bind_at_load Sets a bit in the mach header of the resulting binary which tells dyld to bind all symbols when the binary is loaded, rather than lazily.
-rw-r--r--configure.ac1
1 files changed, 1 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac
index e7d14202a7..a2a11323f2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -784,6 +784,7 @@ dnl this flag screws up non-darwin gcc even when the check fails. special-case i
if test x$TARGET_OS = xdarwin; then
AX_CHECK_LINK_FLAG([[-Wl,-dead_strip]], [LDFLAGS="$LDFLAGS -Wl,-dead_strip"])
AX_CHECK_LINK_FLAG([[-Wl,-dead_strip_dylibs]], [LDFLAGS="$LDFLAGS -Wl,-dead_strip_dylibs"])
+ AX_CHECK_LINK_FLAG([[-Wl,-bind_at_load]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,-bind_at_load"])
fi
AC_CHECK_HEADERS([endian.h sys/endian.h byteswap.h stdio.h stdlib.h unistd.h strings.h sys/types.h sys/stat.h sys/select.h sys/prctl.h sys/sysctl.h vm/vm_param.h sys/vmmeter.h sys/resources.h])