Extended hardening flags.

debian/nginx.rules.in

diff --git a/debian/nginx.rules.in b/debian/nginx.rules.in
index afa208b..bc9e1b8 100755
--- a/debian/nginx.rules.in
+++ b/debian/nginx.rules.in
@@ -5,6 +5,9 @@
 DPKG_EXPORT_BUILDFLAGS = 1
 include /usr/share/dpkg/buildflags.mk
 
+ADD_CFLAGS = -fPIC
+ADD_LDFLAGS = -pie
+
 PKGS = nginx nginx-dbg
 
 BUILDDIR_nginx = $(CURDIR)/debian/build-nginx
@@ -36,12 +39,12 @@
 
 config.status.nginx: config.env.nginx
 	cd $(BUILDDIR_nginx) && \
-	CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS)" --with-ld-opt="$(LDFLAGS)"
+	CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS) $(ADD_CFLAGS)" --with-ld-opt="$(LDFLAGS) $(ADD_LDFLAGS)"
 	touch $@
 
 config.status.nginx_debug: config.env.nginx_debug
 	cd $(BUILDDIR_nginx_debug) && \
-	CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS)" --with-ld-opt="$(LDFLAGS)" --with-debug
+	CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS) $(ADD_CFLAGS)" --with-ld-opt="$(LDFLAGS) $(ADD_LDFLAGS)" --with-debug
 	touch $@
 
 build-arch.%: config.status.%

rpm/SPECS/nginx-module.spec.in

diff --git a/rpm/SPECS/nginx-module.spec.in b/rpm/SPECS/nginx-module.spec.in
index b6a278d..2d07334 100644
--- a/rpm/SPECS/nginx-module.spec.in
+++ b/rpm/SPECS/nginx-module.spec.in
@@ -53,6 +53,7 @@
 %endif
 
 %define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags))
+%define WITH_LD_OPT -Wl,-z,relro -Wl,-z,now
 
 %define BASE_CONFIGURE_ARGS $(echo "%%BASE_CONFIGURE_ARGS%%")
 %define MODULE_CONFIGURE_ARGS $(echo "%%MODULE_CONFIGURE_ARGS%%")
@@ -68,6 +69,7 @@
 cd %{bdir}
 ./configure %{BASE_CONFIGURE_ARGS} %{MODULE_CONFIGURE_ARGS} \
 	--with-cc-opt="%{WITH_CC_OPT}" \
+	--with-ld-opt="%{WITH_LD_OPT}" \
 	--with-debug
 make %{?_smp_mflags} modules
 for so in `find %{bdir}/objs/ -type f -name "*.so"`; do
@@ -75,7 +77,8 @@
 mv $so $debugso
 done
 ./configure %{BASE_CONFIGURE_ARGS} %{MODULE_CONFIGURE_ARGS} \
-	--with-cc-opt="%{WITH_CC_OPT}"
+	--with-cc-opt="%{WITH_CC_OPT}" \
+	--with-ld-opt="%{WITH_LD_OPT}"
 make %{?_smp_mflags} modules
 
 %install

rpm/SPECS/nginx.spec.in

diff --git a/rpm/SPECS/nginx.spec.in b/rpm/SPECS/nginx.spec.in
index 3952167..2658a9f 100644
--- a/rpm/SPECS/nginx.spec.in
+++ b/rpm/SPECS/nginx.spec.in
@@ -52,7 +52,8 @@
 
 %define bdir %{_builddir}/%{name}-%{main_version}
 
-%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags))
+%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags)) -fPIC
+%define WITH_LD_OPT -Wl,-z,relro -Wl,-z,now -pie
 
 %define BASE_CONFIGURE_ARGS $(echo "%%BASE_CONFIGURE_ARGS%%")
 
@@ -104,12 +105,14 @@
 %build
 ./configure %{BASE_CONFIGURE_ARGS} \
     --with-cc-opt="%{WITH_CC_OPT}" \
+    --with-ld-opt="%{WITH_LD_OPT}" \
     --with-debug
 make %{?_smp_mflags}
 %{__mv} %{bdir}/objs/nginx \
     %{bdir}/objs/nginx-debug
 ./configure %{BASE_CONFIGURE_ARGS} \
-    --with-cc-opt="%{WITH_CC_OPT}"
+    --with-cc-opt="%{WITH_CC_OPT}" \
+    --with-ld-opt="%{WITH_LD_OPT}"
 make %{?_smp_mflags}
 
 %install