From: Simon Ruderich <simon@ruderich.org>
Date: Sun, 4 Nov 2018 07:21:33 +0000 (+0100)
Subject: Makefile: use additional hardening flags from Debian
X-Git-Tag: 0.1~7
X-Git-Url: https://ruderich.org/simon/gitweb/?a=commitdiff_plain;h=558cfda92d46baf905c1fad7814b1c92d1ce752f;p=ptyas%2Fptyas.git

Makefile: use additional hardening flags from Debian
---

diff --git a/Makefile b/Makefile
index 48d848a..8ffbbff 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,12 @@
-CFLAGS := -g -O2 -fPIE -fstack-protector-strong -Wall -Wextra -Wconversion $(CFLAGS)
-CPPFLAGS := -D_FORTIFY_SOURCE=2 $(CPPFLAGS)
-LDFLAGS := -fPIE -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)
+CFLAGS := -Wall -Wextra -Wconversion $(CFLAGS)
+# Default on Debian, enforce it for all systems.
+CFLAGS := -fPIE $(CFLAGS)
+LDFLAGS := -fPIE -pie $(LDFLAGS)
+
+# DEB_BUILD_MAINT_OPTIONS='qa=+all,-canary hardening=+all reproducible=+all,-fixdebugpath' dpkg-buildflags --export=make
+export CFLAGS := -g -O2 -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -Werror=implicit-function-declaration -fstack-protector-strong -Wformat -Werror=format-security $(CFLAGS)
+export CPPFLAGS := -Wdate-time -D_FORTIFY_SOURCE=2 $(CPPFLAGS)
+export LDFLAGS := -Wl,-z,relro -Wl,-z,now $(LDFLAGS)
 
 
 ptyas: ptyas.c