Extended hardening flags.
diff --git a/debian/nginx.rules.in b/debian/nginx.rules.in
index afa208b..bc9e1b8 100755
--- a/debian/nginx.rules.in
+++ b/debian/nginx.rules.in
@@ -5,6 +5,9 @@
DPKG_EXPORT_BUILDFLAGS = 1
include /usr/share/dpkg/buildflags.mk
+ADD_CFLAGS = -fPIC
+ADD_LDFLAGS = -pie
+
PKGS = nginx nginx-dbg
BUILDDIR_nginx = $(CURDIR)/debian/build-nginx
@@ -36,12 +39,12 @@
config.status.nginx: config.env.nginx
cd $(BUILDDIR_nginx) && \
- CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS)" --with-ld-opt="$(LDFLAGS)"
+ CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS) $(ADD_CFLAGS)" --with-ld-opt="$(LDFLAGS) $(ADD_LDFLAGS)"
touch $@
config.status.nginx_debug: config.env.nginx_debug
cd $(BUILDDIR_nginx_debug) && \
- CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS)" --with-ld-opt="$(LDFLAGS)" --with-debug
+ CFLAGS="" ./configure %%BASE_CONFIGURE_ARGS%% --with-cc-opt="$(CFLAGS) $(ADD_CFLAGS)" --with-ld-opt="$(LDFLAGS) $(ADD_LDFLAGS)" --with-debug
touch $@
build-arch.%: config.status.%
diff --git a/rpm/SPECS/nginx-module.spec.in b/rpm/SPECS/nginx-module.spec.in
index b6a278d..2d07334 100644
--- a/rpm/SPECS/nginx-module.spec.in
+++ b/rpm/SPECS/nginx-module.spec.in
@@ -53,6 +53,7 @@
%endif
%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags))
+%define WITH_LD_OPT -Wl,-z,relro -Wl,-z,now
%define BASE_CONFIGURE_ARGS $(echo "%%BASE_CONFIGURE_ARGS%%")
%define MODULE_CONFIGURE_ARGS $(echo "%%MODULE_CONFIGURE_ARGS%%")
@@ -68,6 +69,7 @@
cd %{bdir}
./configure %{BASE_CONFIGURE_ARGS} %{MODULE_CONFIGURE_ARGS} \
--with-cc-opt="%{WITH_CC_OPT}" \
+ --with-ld-opt="%{WITH_LD_OPT}" \
--with-debug
make %{?_smp_mflags} modules
for so in `find %{bdir}/objs/ -type f -name "*.so"`; do
@@ -75,7 +77,8 @@
mv $so $debugso
done
./configure %{BASE_CONFIGURE_ARGS} %{MODULE_CONFIGURE_ARGS} \
- --with-cc-opt="%{WITH_CC_OPT}"
+ --with-cc-opt="%{WITH_CC_OPT}" \
+ --with-ld-opt="%{WITH_LD_OPT}"
make %{?_smp_mflags} modules
%install
diff --git a/rpm/SPECS/nginx.spec.in b/rpm/SPECS/nginx.spec.in
index 3952167..2658a9f 100644
--- a/rpm/SPECS/nginx.spec.in
+++ b/rpm/SPECS/nginx.spec.in
@@ -52,7 +52,8 @@
%define bdir %{_builddir}/%{name}-%{main_version}
-%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags))
+%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags)) -fPIC
+%define WITH_LD_OPT -Wl,-z,relro -Wl,-z,now -pie
%define BASE_CONFIGURE_ARGS $(echo "%%BASE_CONFIGURE_ARGS%%")
@@ -104,12 +105,14 @@
%build
./configure %{BASE_CONFIGURE_ARGS} \
--with-cc-opt="%{WITH_CC_OPT}" \
+ --with-ld-opt="%{WITH_LD_OPT}" \
--with-debug
make %{?_smp_mflags}
%{__mv} %{bdir}/objs/nginx \
%{bdir}/objs/nginx-debug
./configure %{BASE_CONFIGURE_ARGS} \
- --with-cc-opt="%{WITH_CC_OPT}"
+ --with-cc-opt="%{WITH_CC_OPT}" \
+ --with-ld-opt="%{WITH_LD_OPT}"
make %{?_smp_mflags}
%install
