From 359c2d9d5d00293c210e16a89ed86a9e4881075c Mon Sep 17 00:00:00 2001 From: Leonid Plyushch Date: Sun, 4 Aug 2019 18:34:16 +0300 Subject: [PATCH] build-package.sh: setup basic hardening through CFLAGS/LDFLAGS Use stack protector & make GOT/PLT sections read-only. --- scripts/build/termux_step_setup_toolchain.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/scripts/build/termux_step_setup_toolchain.sh b/scripts/build/termux_step_setup_toolchain.sh index a8bece4f4..57888e487 100644 --- a/scripts/build/termux_step_setup_toolchain.sh +++ b/scripts/build/termux_step_setup_toolchain.sh @@ -46,11 +46,15 @@ termux_step_setup_toolchain() { fi if [ -n "$TERMUX_DEBUG" ]; then - CFLAGS+=" -g3 -O1 -fstack-protector --param ssp-buffer-size=4 -D_FORTIFY_SOURCE=2" + CFLAGS+=" -g3 -O1 -D_FORTIFY_SOURCE=2" else CFLAGS+=" -Oz" fi + # Basic hardening. + CFLAGS+=" -fstack-protector-strong" + LDFLAGS+=" -Wl,-z,relro,-z,now" + export CXXFLAGS="$CFLAGS" export CPPFLAGS="-I${TERMUX_PREFIX}/include" @@ -113,12 +117,12 @@ termux_step_setup_toolchain() { sed -i 's/clang/clang -E/' \ $_TERMUX_TOOLCHAIN_TMPDIR/bin/$HOST_PLAT-cpp cp $_TERMUX_TOOLCHAIN_TMPDIR/bin/$HOST_PLAT-clang \ - $_TERMUX_TOOLCHAIN_TMPDIR/bin/$HOST_PLAT-gcc + $_TERMUX_TOOLCHAIN_TMPDIR/bin/$HOST_PLAT-gcc cp $_TERMUX_TOOLCHAIN_TMPDIR/bin/$HOST_PLAT-clang++ \ $_TERMUX_TOOLCHAIN_TMPDIR/bin/$HOST_PLAT-gcc done cp $_TERMUX_TOOLCHAIN_TMPDIR/bin/armv7a-linux-androideabi$TERMUX_PKG_API_LEVEL-clang \ - $_TERMUX_TOOLCHAIN_TMPDIR/bin/arm-linux-androideabi-clang + $_TERMUX_TOOLCHAIN_TMPDIR/bin/arm-linux-androideabi-clang cp $_TERMUX_TOOLCHAIN_TMPDIR/bin/armv7a-linux-androideabi$TERMUX_PKG_API_LEVEL-clang++ \ $_TERMUX_TOOLCHAIN_TMPDIR/bin/arm-linux-androideabi-clang++ cp $_TERMUX_TOOLCHAIN_TMPDIR/bin/armv7a-linux-androideabi-cpp \