foster/bitcoin-bitcoin-core
0
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-02-08 10:31:50 -05:00
Code Issues Activity

guix: enable hardening options in GCC Build

Browse source 
Pass `--enable-default-pie` and `--enable-default-ssp` when configuring
our GCCs. This achieves the following:

--enable-default-pie
	Turn on -fPIE and -pie by default.

--enable-default-ssp
	Turn on -fstack-protector-strong by default.

Note that this isn't a replacement for passing hardneing flags
ourselves, but introduces some redundency, and there isn't really a
reason to not build a more "hardenings enabled" toolchain by default.

See also:
https://gcc.gnu.org/install/configure.html
This commit is contained in:
fanquake 2022-06-20 15:30:19 +01:00
parent aa87879a77
commit c99a1ecc52
No known key found for this signature in database
GPG key ID: 2EEB9F5CC09526C1
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
contrib/guix/manifest.scm
View file

@ -132,12 +132,19 @@ chain for " target " development."))
(define base-gcc gcc-10)
(define base-linux-kernel-headers linux-libre-headers-5.15)
;; https://gcc.gnu.org/install/configure.html
(define (hardened-gcc gcc)
(package-with-extra-configure-variable (
package-with-extra-configure-variable gcc
"--enable-default-ssp" "yes")
"--enable-default-pie" "yes"))
(define* (make-bitcoin-cross-toolchain target
#:key
(base-gcc-for-libc base-gcc)
(base-kernel-headers base-linux-kernel-headers)
(base-libc (make-glibc-with-bind-now (make-glibc-without-werror glibc-2.24)))
(base-gcc (make-gcc-rpath-link base-gcc)))
(base-gcc (make-gcc-rpath-link (hardened-gcc base-gcc))))
"Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
desirable for building Bitcoin Core release binaries."
(make-cross-toolchain target