diff options
| author | fanquake <fanquake@gmail.com> | 2019-12-06 15:34:39 -0500 |
|---|---|---|
| committer | fanquake <fanquake@gmail.com> | 2019-12-13 09:33:20 -0500 |
| commit | c78b123982d59fe2d633659f23d6893de627f3f6 (patch) | |
| tree | 1dde3a95fe7205e43db726a675b90ffddc21cfed /configure.ac | |
| parent | 988fe5b1adc0cb551dfacd7d3eedf4bd7edc918a (diff) | |
build: add -bind_at_load to hardened LDFLAGS
This performs the same function as -Wl,-z,now, except for ld on macOS.
You can check the binaries using otool -l, looking for the
LC_DYLD_INFO_ONLY section. lazy_bind_off and lazy_bind_size should both
be 0.
man ld:
-bind_at_load
Sets a bit in the mach header of the resulting binary which tells dyld
to bind all symbols when the binary is loaded, rather than lazily.
Diffstat (limited to 'configure.ac')
| -rw-r--r-- | configure.ac | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac index e7d14202a7..a2a11323f2 100644 --- a/configure.ac +++ b/configure.ac @@ -784,6 +784,7 @@ dnl this flag screws up non-darwin gcc even when the check fails. special-case i if test x$TARGET_OS = xdarwin; then AX_CHECK_LINK_FLAG([[-Wl,-dead_strip]], [LDFLAGS="$LDFLAGS -Wl,-dead_strip"]) AX_CHECK_LINK_FLAG([[-Wl,-dead_strip_dylibs]], [LDFLAGS="$LDFLAGS -Wl,-dead_strip_dylibs"]) + AX_CHECK_LINK_FLAG([[-Wl,-bind_at_load]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,-bind_at_load"]) fi AC_CHECK_HEADERS([endian.h sys/endian.h byteswap.h stdio.h stdlib.h unistd.h strings.h sys/types.h sys/stat.h sys/select.h sys/prctl.h sys/sysctl.h vm/vm_param.h sys/vmmeter.h sys/resources.h]) |