aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBrent Cook <busterb@gmail.com>2015-01-05 20:14:54 -0600
committerBrent Cook <bcook@openbsd.org>2015-01-05 20:23:48 -0600
commit303b972d554493e0be1c63061500f730ca88e4a8 (patch)
treee4a1b8497034bfd1daad4efa5df2a4c79f6abe16
parent5be407a42427a298cc00241f5d6bf67c9c7fa041 (diff)
downloadportable-303b972d554493e0be1c63061500f730ca88e4a8.tar.gz
portable-303b972d554493e0be1c63061500f730ca88e4a8.tar.bz2
portable-303b972d554493e0be1c63061500f730ca88e4a8.zip
simplify hardening check logic, disable for mingw
Rather than doing separate linker/compiler checks, just build a non-empty program with each so that the compiler will actually try to use the hardening features. Reduce redundancy in the macro calls by just setting the flag that was just tested. Also, disable hardening for mingw, since its trying to use a libssp-0.dll file that I can't find right now. The detected hardening flags break mingw builds currently.
-rw-r--r--configure.ac71
-rw-r--r--m4/ax_check_compile_flag.m474
-rw-r--r--m4/ax_check_link_flag.m473
3 files changed, 33 insertions, 185 deletions
diff --git a/configure.ac b/configure.ac
index 18321bc..a9f8b6e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -80,58 +80,53 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[
80AC_MSG_RESULT([$CLANG]) 80AC_MSG_RESULT([$CLANG])
81AS_IF([test "x$CLANG" == "xyes"], [CLANG_FLAGS=-Qunused-arguments]) 81AS_IF([test "x$CLANG" == "xyes"], [CLANG_FLAGS=-Qunused-arguments])
82 82
83# We want to check for compiler flag support. Prior to clang v5.1, there was no way to make 83# We want to check for compiler flag support. Prior to clang v5.1, there was no
84# clang's "argument unused" warning fatal. So we invoke the compiler through a 84# way to make clang's "argument unused" warning fatal. So we invoke the
85# wrapper script that greps for this message. 85# compiler through a wrapper script that greps for this message.
86saved_CC="$CC" 86saved_CC="$CC"
87saved_LD="$LD" 87saved_LD="$LD"
88flag_wrap="$srcdir/scripts/wrap-compiler-for-flag-check" 88flag_wrap="$srcdir/scripts/wrap-compiler-for-flag-check"
89CC="$flag_wrap $CC" 89CC="$flag_wrap $CC"
90LD="$flag_wrap $LD" 90LD="$flag_wrap $LD"
91 91
92AC_DEFUN([check_cflag],
93 [AX_CHECK_COMPILE_FLAG([$1], [$2], [$3], [-Werror $4])])
94AC_DEFUN([check_ldflag],
95 [AX_CHECK_LINK_FLAG([$1], [$2], [$3], [-Werror $4])])
96
97
98AC_ARG_ENABLE([hardening], 92AC_ARG_ENABLE([hardening],
99 [AS_HELP_STRING([--disable-hardening], [Disable options to frustrate memory corruption exploits])], 93 [AS_HELP_STRING([--disable-hardening],
100 [], 94 [Disable options to frustrate memory corruption exploits])],
101 [enable_hardening=yes]) 95 [], [enable_hardening=yes])
102 96
103HARDEN_CFLAGS="" 97AC_DEFUN([CHECK_CFLAG],
104HARDEN_LDFLAGS="" 98 [AC_LANG_ASSERT(C)
105AS_IF([test "x$enable_hardening" == "xyes"], [ 99 AC_MSG_CHECKING([if $saved_CC supports "$1"])
100 old_cflags="$CFLAGS"
101 CFLAGS=[$1]
102 AC_TRY_LINK([#include <stdio.h>],
103 [printf("Hello")],
104 AC_MSG_RESULT([yes])
105 HARDEN_CFLAGS="$HARDEN_CFLAGS [$1]",
106 AC_MSG_RESULT([no])
107 $2
108 )
109 ])
110
111AS_IF([test "x$enable_hardening" == "xyes" -a "x$HOST_OS" != "xwin"], [
106 # Tell GCC to NOT optimize based on signed arithmetic overflow 112 # Tell GCC to NOT optimize based on signed arithmetic overflow
107 check_cflag([-fno-strict-overflow], [HARDEN_CFLAGS="$HARDEN_CFLAGS -fno-strict-overflow"]) 113 CHECK_CFLAG([-fno-strict-overflow])
108 114
109 # _FORTIFY_SOURCE replaces builtin functions with safer versions. 115 # _FORTIFY_SOURCE replaces builtin functions with safer versions.
110 check_cflag([-D_FORTIFY_SOURCE=2], 116 CHECK_CFLAG([-D_FORTIFY_SOURCE=2])
111 [HARDEN_CFLAGS="$HARDEN_CFLAGS -D_FORTIFY_SOURCE=2"]) 117
112 118 # Use stack-protector-strong if available; if not, fallback to
113 # Use stack-protector-strong if available; if not, fallback to stack-protector-all which 119 # stack-protector-all which is considered to be overkill
114 # is considered to be overkill 120 CHECK_CFLAG([-fstack-protector-strong],
115 check_cflag([-fstack-protector-strong], 121 CHECK_CFLAG([-fstack-protector-all],
116 [STACK_PROTECT="-fstack-protector-strong"], 122 AC_MSG_ERROR([compiler does appear to support stack protection
117 check_cflag([-fstack-protector-all], 123 - use --disable-hardening to override])
118 [STACK_PROTECT="-fstack-protector-all"],
119 [AC_MSG_ERROR([compiler does not support stack protection - use --disable-hardening to override if you understand the risks])]
120 ) 124 )
121 ) 125 )
122 126
123 check_ldflag([$STACK_PROTECT],
124 [HARDEN_CFLAGS="$HARDEN_CFLAGS $STACK_PROTECT"
125 check_cflag([-Wstack-protector], [HARDEN_CFLAGS="$HARDEN_CFLAGS -Wstack-protector"],
126 [], [$STACK_PROTECT])
127 ],
128 [AC_MSG_ERROR([compiler supports stack protection but linker does not])]
129 )
130
131 # Enable read only relocations 127 # Enable read only relocations
132 check_ldflag([-Wl,-z,relro], 128 CHECK_CFLAG([-Wl,-z,relro])
133 [HARDEN_LDFLAGS="$HARDEN_LDFLAGS -Wl,-z,relro" 129 CHECK_CFLAG([-Wl,-z,now])
134 check_ldflag([-Wl,-z,now], [HARDEN_LDFLAGS="$HARDEN_LDFLAGS -Wl,-z,now"])])
135]) 130])
136 131
137# Restore CC, LD 132# Restore CC, LD
diff --git a/m4/ax_check_compile_flag.m4 b/m4/ax_check_compile_flag.m4
deleted file mode 100644
index 51df0c0..0000000
--- a/m4/ax_check_compile_flag.m4
+++ /dev/null
@@ -1,74 +0,0 @@
1# ===========================================================================
2# http://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html
3# ===========================================================================
4#
5# SYNOPSIS
6#
7# AX_CHECK_COMPILE_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT])
8#
9# DESCRIPTION
10#
11# Check whether the given FLAG works with the current language's compiler
12# or gives an error. (Warnings, however, are ignored)
13#
14# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
15# success/failure.
16#
17# If EXTRA-FLAGS is defined, it is added to the current language's default
18# flags (e.g. CFLAGS) when the check is done. The check is thus made with
19# the flags: "CFLAGS EXTRA-FLAGS FLAG". This can for example be used to
20# force the compiler to issue an error when a bad flag is given.
21#
22# INPUT gives an alternative input source to AC_COMPILE_IFELSE.
23#
24# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
25# macro in sync with AX_CHECK_{PREPROC,LINK}_FLAG.
26#
27# LICENSE
28#
29# Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
30# Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
31#
32# This program is free software: you can redistribute it and/or modify it
33# under the terms of the GNU General Public License as published by the
34# Free Software Foundation, either version 3 of the License, or (at your
35# option) any later version.
36#
37# This program is distributed in the hope that it will be useful, but
38# WITHOUT ANY WARRANTY; without even the implied warranty of
39# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
40# Public License for more details.
41#
42# You should have received a copy of the GNU General Public License along
43# with this program. If not, see <http://www.gnu.org/licenses/>.
44#
45# As a special exception, the respective Autoconf Macro's copyright owner
46# gives unlimited permission to copy, distribute and modify the configure
47# scripts that are the output of Autoconf when processing the Macro. You
48# need not follow the terms of the GNU General Public License when using
49# or distributing such scripts, even though portions of the text of the
50# Macro appear in them. The GNU General Public License (GPL) does govern
51# all other use of the material that constitutes the Autoconf Macro.
52#
53# This special exception to the GPL applies to versions of the Autoconf
54# Macro released by the Autoconf Archive. When you make and distribute a
55# modified version of the Autoconf Macro, you may extend this special
56# exception to the GPL to apply to your modified version as well.
57
58#serial 3
59
60AC_DEFUN([AX_CHECK_COMPILE_FLAG],
61[AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX
62AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_[]_AC_LANG_ABBREV[]flags_$4_$1])dnl
63AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [
64 ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS
65 _AC_LANG_PREFIX[]FLAGS="$[]_AC_LANG_PREFIX[]FLAGS $4 $1"
66 AC_COMPILE_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])],
67 [AS_VAR_SET(CACHEVAR,[yes])],
68 [AS_VAR_SET(CACHEVAR,[no])])
69 _AC_LANG_PREFIX[]FLAGS=$ax_check_save_flags])
70AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
71 [m4_default([$2], :)],
72 [m4_default([$3], :)])
73AS_VAR_POPDEF([CACHEVAR])dnl
74])dnl AX_CHECK_COMPILE_FLAGS
diff --git a/m4/ax_check_link_flag.m4 b/m4/ax_check_link_flag.m4
deleted file mode 100644
index db899dd..0000000
--- a/m4/ax_check_link_flag.m4
+++ /dev/null
@@ -1,73 +0,0 @@
1# ===========================================================================
2# http://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
3# ===========================================================================
4#
5# SYNOPSIS
6#
7# AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT])
8#
9# DESCRIPTION
10#
11# Check whether the given FLAG works with the linker or gives an error.
12# (Warnings, however, are ignored)
13#
14# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
15# success/failure.
16#
17# If EXTRA-FLAGS is defined, it is added to the linker's default flags
18# when the check is done. The check is thus made with the flags: "LDFLAGS
19# EXTRA-FLAGS FLAG". This can for example be used to force the linker to
20# issue an error when a bad flag is given.
21#
22# INPUT gives an alternative input source to AC_LINK_IFELSE.
23#
24# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
25# macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG.
26#
27# LICENSE
28#
29# Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
30# Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
31#
32# This program is free software: you can redistribute it and/or modify it
33# under the terms of the GNU General Public License as published by the
34# Free Software Foundation, either version 3 of the License, or (at your
35# option) any later version.
36#
37# This program is distributed in the hope that it will be useful, but
38# WITHOUT ANY WARRANTY; without even the implied warranty of
39# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
40# Public License for more details.
41#
42# You should have received a copy of the GNU General Public License along
43# with this program. If not, see <http://www.gnu.org/licenses/>.
44#
45# As a special exception, the respective Autoconf Macro's copyright owner
46# gives unlimited permission to copy, distribute and modify the configure
47# scripts that are the output of Autoconf when processing the Macro. You
48# need not follow the terms of the GNU General Public License when using
49# or distributing such scripts, even though portions of the text of the
50# Macro appear in them. The GNU General Public License (GPL) does govern
51# all other use of the material that constitutes the Autoconf Macro.
52#
53# This special exception to the GPL applies to versions of the Autoconf
54# Macro released by the Autoconf Archive. When you make and distribute a
55# modified version of the Autoconf Macro, you may extend this special
56# exception to the GPL to apply to your modified version as well.
57
58#serial 3
59
60AC_DEFUN([AX_CHECK_LINK_FLAG],
61[AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
62AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
63 ax_check_save_flags=$LDFLAGS
64 LDFLAGS="$LDFLAGS $4 $1"
65 AC_LINK_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])],
66 [AS_VAR_SET(CACHEVAR,[yes])],
67 [AS_VAR_SET(CACHEVAR,[no])])
68 LDFLAGS=$ax_check_save_flags])
69AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
70 [m4_default([$2], :)],
71 [m4_default([$3], :)])
72AS_VAR_POPDEF([CACHEVAR])dnl
73])dnl AX_CHECK_LINK_FLAGS