diff options
-rw-r--r-- | configure.ac | 71 | ||||
-rw-r--r-- | m4/ax_check_compile_flag.m4 | 74 | ||||
-rw-r--r-- | m4/ax_check_link_flag.m4 | 73 |
3 files changed, 33 insertions, 185 deletions
diff --git a/configure.ac b/configure.ac index 18321bc..a9f8b6e 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -80,58 +80,53 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[ | |||
80 | AC_MSG_RESULT([$CLANG]) | 80 | AC_MSG_RESULT([$CLANG]) |
81 | AS_IF([test "x$CLANG" == "xyes"], [CLANG_FLAGS=-Qunused-arguments]) | 81 | AS_IF([test "x$CLANG" == "xyes"], [CLANG_FLAGS=-Qunused-arguments]) |
82 | 82 | ||
83 | # We want to check for compiler flag support. Prior to clang v5.1, there was no way to make | 83 | # We want to check for compiler flag support. Prior to clang v5.1, there was no |
84 | # clang's "argument unused" warning fatal. So we invoke the compiler through a | 84 | # way to make clang's "argument unused" warning fatal. So we invoke the |
85 | # wrapper script that greps for this message. | 85 | # compiler through a wrapper script that greps for this message. |
86 | saved_CC="$CC" | 86 | saved_CC="$CC" |
87 | saved_LD="$LD" | 87 | saved_LD="$LD" |
88 | flag_wrap="$srcdir/scripts/wrap-compiler-for-flag-check" | 88 | flag_wrap="$srcdir/scripts/wrap-compiler-for-flag-check" |
89 | CC="$flag_wrap $CC" | 89 | CC="$flag_wrap $CC" |
90 | LD="$flag_wrap $LD" | 90 | LD="$flag_wrap $LD" |
91 | 91 | ||
92 | AC_DEFUN([check_cflag], | ||
93 | [AX_CHECK_COMPILE_FLAG([$1], [$2], [$3], [-Werror $4])]) | ||
94 | AC_DEFUN([check_ldflag], | ||
95 | [AX_CHECK_LINK_FLAG([$1], [$2], [$3], [-Werror $4])]) | ||
96 | |||
97 | |||
98 | AC_ARG_ENABLE([hardening], | 92 | AC_ARG_ENABLE([hardening], |
99 | [AS_HELP_STRING([--disable-hardening], [Disable options to frustrate memory corruption exploits])], | 93 | [AS_HELP_STRING([--disable-hardening], |
100 | [], | 94 | [Disable options to frustrate memory corruption exploits])], |
101 | [enable_hardening=yes]) | 95 | [], [enable_hardening=yes]) |
102 | 96 | ||
103 | HARDEN_CFLAGS="" | 97 | AC_DEFUN([CHECK_CFLAG], |
104 | HARDEN_LDFLAGS="" | 98 | [AC_LANG_ASSERT(C) |
105 | AS_IF([test "x$enable_hardening" == "xyes"], [ | 99 | AC_MSG_CHECKING([if $saved_CC supports "$1"]) |
100 | old_cflags="$CFLAGS" | ||
101 | CFLAGS=[$1] | ||
102 | AC_TRY_LINK([#include <stdio.h>], | ||
103 | [printf("Hello")], | ||
104 | AC_MSG_RESULT([yes]) | ||
105 | HARDEN_CFLAGS="$HARDEN_CFLAGS [$1]", | ||
106 | AC_MSG_RESULT([no]) | ||
107 | $2 | ||
108 | ) | ||
109 | ]) | ||
110 | |||
111 | AS_IF([test "x$enable_hardening" == "xyes" -a "x$HOST_OS" != "xwin"], [ | ||
106 | # Tell GCC to NOT optimize based on signed arithmetic overflow | 112 | # Tell GCC to NOT optimize based on signed arithmetic overflow |
107 | check_cflag([-fno-strict-overflow], [HARDEN_CFLAGS="$HARDEN_CFLAGS -fno-strict-overflow"]) | 113 | CHECK_CFLAG([-fno-strict-overflow]) |
108 | 114 | ||
109 | # _FORTIFY_SOURCE replaces builtin functions with safer versions. | 115 | # _FORTIFY_SOURCE replaces builtin functions with safer versions. |
110 | check_cflag([-D_FORTIFY_SOURCE=2], | 116 | CHECK_CFLAG([-D_FORTIFY_SOURCE=2]) |
111 | [HARDEN_CFLAGS="$HARDEN_CFLAGS -D_FORTIFY_SOURCE=2"]) | 117 | |
112 | 118 | # Use stack-protector-strong if available; if not, fallback to | |
113 | # Use stack-protector-strong if available; if not, fallback to stack-protector-all which | 119 | # stack-protector-all which is considered to be overkill |
114 | # is considered to be overkill | 120 | CHECK_CFLAG([-fstack-protector-strong], |
115 | check_cflag([-fstack-protector-strong], | 121 | CHECK_CFLAG([-fstack-protector-all], |
116 | [STACK_PROTECT="-fstack-protector-strong"], | 122 | AC_MSG_ERROR([compiler does appear to support stack protection |
117 | check_cflag([-fstack-protector-all], | 123 | - use --disable-hardening to override]) |
118 | [STACK_PROTECT="-fstack-protector-all"], | ||
119 | [AC_MSG_ERROR([compiler does not support stack protection - use --disable-hardening to override if you understand the risks])] | ||
120 | ) | 124 | ) |
121 | ) | 125 | ) |
122 | 126 | ||
123 | check_ldflag([$STACK_PROTECT], | ||
124 | [HARDEN_CFLAGS="$HARDEN_CFLAGS $STACK_PROTECT" | ||
125 | check_cflag([-Wstack-protector], [HARDEN_CFLAGS="$HARDEN_CFLAGS -Wstack-protector"], | ||
126 | [], [$STACK_PROTECT]) | ||
127 | ], | ||
128 | [AC_MSG_ERROR([compiler supports stack protection but linker does not])] | ||
129 | ) | ||
130 | |||
131 | # Enable read only relocations | 127 | # Enable read only relocations |
132 | check_ldflag([-Wl,-z,relro], | 128 | CHECK_CFLAG([-Wl,-z,relro]) |
133 | [HARDEN_LDFLAGS="$HARDEN_LDFLAGS -Wl,-z,relro" | 129 | CHECK_CFLAG([-Wl,-z,now]) |
134 | check_ldflag([-Wl,-z,now], [HARDEN_LDFLAGS="$HARDEN_LDFLAGS -Wl,-z,now"])]) | ||
135 | ]) | 130 | ]) |
136 | 131 | ||
137 | # Restore CC, LD | 132 | # Restore CC, LD |
diff --git a/m4/ax_check_compile_flag.m4 b/m4/ax_check_compile_flag.m4 deleted file mode 100644 index 51df0c0..0000000 --- a/m4/ax_check_compile_flag.m4 +++ /dev/null | |||
@@ -1,74 +0,0 @@ | |||
1 | # =========================================================================== | ||
2 | # http://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html | ||
3 | # =========================================================================== | ||
4 | # | ||
5 | # SYNOPSIS | ||
6 | # | ||
7 | # AX_CHECK_COMPILE_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT]) | ||
8 | # | ||
9 | # DESCRIPTION | ||
10 | # | ||
11 | # Check whether the given FLAG works with the current language's compiler | ||
12 | # or gives an error. (Warnings, however, are ignored) | ||
13 | # | ||
14 | # ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on | ||
15 | # success/failure. | ||
16 | # | ||
17 | # If EXTRA-FLAGS is defined, it is added to the current language's default | ||
18 | # flags (e.g. CFLAGS) when the check is done. The check is thus made with | ||
19 | # the flags: "CFLAGS EXTRA-FLAGS FLAG". This can for example be used to | ||
20 | # force the compiler to issue an error when a bad flag is given. | ||
21 | # | ||
22 | # INPUT gives an alternative input source to AC_COMPILE_IFELSE. | ||
23 | # | ||
24 | # NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this | ||
25 | # macro in sync with AX_CHECK_{PREPROC,LINK}_FLAG. | ||
26 | # | ||
27 | # LICENSE | ||
28 | # | ||
29 | # Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de> | ||
30 | # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com> | ||
31 | # | ||
32 | # This program is free software: you can redistribute it and/or modify it | ||
33 | # under the terms of the GNU General Public License as published by the | ||
34 | # Free Software Foundation, either version 3 of the License, or (at your | ||
35 | # option) any later version. | ||
36 | # | ||
37 | # This program is distributed in the hope that it will be useful, but | ||
38 | # WITHOUT ANY WARRANTY; without even the implied warranty of | ||
39 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General | ||
40 | # Public License for more details. | ||
41 | # | ||
42 | # You should have received a copy of the GNU General Public License along | ||
43 | # with this program. If not, see <http://www.gnu.org/licenses/>. | ||
44 | # | ||
45 | # As a special exception, the respective Autoconf Macro's copyright owner | ||
46 | # gives unlimited permission to copy, distribute and modify the configure | ||
47 | # scripts that are the output of Autoconf when processing the Macro. You | ||
48 | # need not follow the terms of the GNU General Public License when using | ||
49 | # or distributing such scripts, even though portions of the text of the | ||
50 | # Macro appear in them. The GNU General Public License (GPL) does govern | ||
51 | # all other use of the material that constitutes the Autoconf Macro. | ||
52 | # | ||
53 | # This special exception to the GPL applies to versions of the Autoconf | ||
54 | # Macro released by the Autoconf Archive. When you make and distribute a | ||
55 | # modified version of the Autoconf Macro, you may extend this special | ||
56 | # exception to the GPL to apply to your modified version as well. | ||
57 | |||
58 | #serial 3 | ||
59 | |||
60 | AC_DEFUN([AX_CHECK_COMPILE_FLAG], | ||
61 | [AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX | ||
62 | AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_[]_AC_LANG_ABBREV[]flags_$4_$1])dnl | ||
63 | AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [ | ||
64 | ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS | ||
65 | _AC_LANG_PREFIX[]FLAGS="$[]_AC_LANG_PREFIX[]FLAGS $4 $1" | ||
66 | AC_COMPILE_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])], | ||
67 | [AS_VAR_SET(CACHEVAR,[yes])], | ||
68 | [AS_VAR_SET(CACHEVAR,[no])]) | ||
69 | _AC_LANG_PREFIX[]FLAGS=$ax_check_save_flags]) | ||
70 | AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes], | ||
71 | [m4_default([$2], :)], | ||
72 | [m4_default([$3], :)]) | ||
73 | AS_VAR_POPDEF([CACHEVAR])dnl | ||
74 | ])dnl AX_CHECK_COMPILE_FLAGS | ||
diff --git a/m4/ax_check_link_flag.m4 b/m4/ax_check_link_flag.m4 deleted file mode 100644 index db899dd..0000000 --- a/m4/ax_check_link_flag.m4 +++ /dev/null | |||
@@ -1,73 +0,0 @@ | |||
1 | # =========================================================================== | ||
2 | # http://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html | ||
3 | # =========================================================================== | ||
4 | # | ||
5 | # SYNOPSIS | ||
6 | # | ||
7 | # AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT]) | ||
8 | # | ||
9 | # DESCRIPTION | ||
10 | # | ||
11 | # Check whether the given FLAG works with the linker or gives an error. | ||
12 | # (Warnings, however, are ignored) | ||
13 | # | ||
14 | # ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on | ||
15 | # success/failure. | ||
16 | # | ||
17 | # If EXTRA-FLAGS is defined, it is added to the linker's default flags | ||
18 | # when the check is done. The check is thus made with the flags: "LDFLAGS | ||
19 | # EXTRA-FLAGS FLAG". This can for example be used to force the linker to | ||
20 | # issue an error when a bad flag is given. | ||
21 | # | ||
22 | # INPUT gives an alternative input source to AC_LINK_IFELSE. | ||
23 | # | ||
24 | # NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this | ||
25 | # macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG. | ||
26 | # | ||
27 | # LICENSE | ||
28 | # | ||
29 | # Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de> | ||
30 | # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com> | ||
31 | # | ||
32 | # This program is free software: you can redistribute it and/or modify it | ||
33 | # under the terms of the GNU General Public License as published by the | ||
34 | # Free Software Foundation, either version 3 of the License, or (at your | ||
35 | # option) any later version. | ||
36 | # | ||
37 | # This program is distributed in the hope that it will be useful, but | ||
38 | # WITHOUT ANY WARRANTY; without even the implied warranty of | ||
39 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General | ||
40 | # Public License for more details. | ||
41 | # | ||
42 | # You should have received a copy of the GNU General Public License along | ||
43 | # with this program. If not, see <http://www.gnu.org/licenses/>. | ||
44 | # | ||
45 | # As a special exception, the respective Autoconf Macro's copyright owner | ||
46 | # gives unlimited permission to copy, distribute and modify the configure | ||
47 | # scripts that are the output of Autoconf when processing the Macro. You | ||
48 | # need not follow the terms of the GNU General Public License when using | ||
49 | # or distributing such scripts, even though portions of the text of the | ||
50 | # Macro appear in them. The GNU General Public License (GPL) does govern | ||
51 | # all other use of the material that constitutes the Autoconf Macro. | ||
52 | # | ||
53 | # This special exception to the GPL applies to versions of the Autoconf | ||
54 | # Macro released by the Autoconf Archive. When you make and distribute a | ||
55 | # modified version of the Autoconf Macro, you may extend this special | ||
56 | # exception to the GPL to apply to your modified version as well. | ||
57 | |||
58 | #serial 3 | ||
59 | |||
60 | AC_DEFUN([AX_CHECK_LINK_FLAG], | ||
61 | [AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl | ||
62 | AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [ | ||
63 | ax_check_save_flags=$LDFLAGS | ||
64 | LDFLAGS="$LDFLAGS $4 $1" | ||
65 | AC_LINK_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])], | ||
66 | [AS_VAR_SET(CACHEVAR,[yes])], | ||
67 | [AS_VAR_SET(CACHEVAR,[no])]) | ||
68 | LDFLAGS=$ax_check_save_flags]) | ||
69 | AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes], | ||
70 | [m4_default([$2], :)], | ||
71 | [m4_default([$3], :)]) | ||
72 | AS_VAR_POPDEF([CACHEVAR])dnl | ||
73 | ])dnl AX_CHECK_LINK_FLAGS | ||