blob: 08fdd52be08a8572c7222df33567f53d1aec0940 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
hardeningFlags+=("${hardeningEnable[@]}")
hardeningCFlags=()
hardeningLDFlags=()
if [[ ! $hardeningDisable == "all" ]]; then
for flag in "${hardeningFlags[@]}"
do
if [[ ! "$hardeningDisable" =~ "$flag" ]]; then
case $flag in
fortify)
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
;;
stackprotector)
hardeningCFlags+=('-fstack-protector-strong')
;;
pie)
hardeningCFlags+=('-fPIE' '-pie')
;;
pic)
hardeningCFlags+=('-fPIC')
;;
strictoverflow)
hardeningCFlags+=('-fno-strict-overflow')
;;
format)
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
;;
relro)
hardeningLDFlags+=('-z relro')
;;
bindnow)
hardeningLDFlags+=('-z now')
;;
*)
echo "Hardening flag unknown: $flag"
;;
esac
fi
done
fi
|