Skip to content

Commit

Permalink
build: add binary hardening compile and link flags (XRPLF#4603)
Browse files Browse the repository at this point in the history
Enhance security during the build process:

* The '-fstack-protector' flag enables stack protection for preventing
  buffer overflow vulnerabilities. If an attempt is made to overflow the
  buffer, the program will terminate, thus protecting the integrity of
  the stack.
* The '-Wl,-z,relro,-z,now' linker flag enables Read-only Relocations
  (RELRO), a feature that helps harden the binary against certain types
  of exploits, particularly those that involve overwriting the Global
  Offset Table (GOT).
  * This flag is only set for Linux builds, due to compatibility issues
    with apple-clang.
  * The `relro` option makes certain sections of memory read-only after
    initialization to prevent them from being overwritten, while `now`
    ensures that all dynamic symbols are resolved immediately on program
    start, reducing the window of opportunity for attacks.
  • Loading branch information
thejohnfreeman authored and ckeshava committed Sep 25, 2023
1 parent 1d24e13 commit e4f3c9c
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion Builds/CMake/RippledCompiler.cmake
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ link_libraries (Ripple::common)
set_target_properties (common
PROPERTIES INTERFACE_POSITION_INDEPENDENT_CODE ON)
set(CMAKE_CXX_EXTENSIONS OFF)
target_compile_features (common INTERFACE cxx_std_17)
target_compile_definitions (common
INTERFACE
$<$<CONFIG:Debug>:DEBUG _DEBUG>
Expand Down Expand Up @@ -108,6 +107,7 @@ else ()
-Wno-char-subscripts
-Wno-format
-Wno-unused-local-typedefs
-fstack-protector
$<$<BOOL:${is_gcc}>:
-Wno-unused-but-set-variable
-Wno-deprecated
Expand All @@ -120,6 +120,7 @@ else ()
target_link_libraries (common
INTERFACE
-rdynamic
$<$<BOOL:${is_linux}>:-Wl,-z,relro,-z,now>
# link to static libc/c++ iff:
# * static option set and
# * NOT APPLE (AppleClang does not support static libc/c++) and
Expand Down

0 comments on commit e4f3c9c

Please sign in to comment.