Extended hardening flags.

Also merged the following changes:

9cdf4996e622 debian: use DEB_*_MAINT_APPEND for passing additional flags.
bf7d1d05187d debian: additional compiler/linker flags updated.

debian/nginx-module.rules.in

diff --git a/debian/nginx-module.rules.in b/debian/nginx-module.rules.in
index bbbacfe..1705d5e 100755
--- a/debian/nginx-module.rules.in
+++ b/debian/nginx-module.rules.in
@@ -2,6 +2,7 @@
 
 #export DH_VERBOSE=1
 export DEB_BUILD_MAINT_OPTIONS=hardening=+all,-pie                              
+export DEB_CFLAGS_MAINT_APPEND=-Wp,-D_FORTIFY_SOURCE=2
 DPKG_EXPORT_BUILDFLAGS = 1                                                      
 include /usr/share/dpkg/buildflags.mk
 

debian/nginx.rules.in

diff --git a/debian/nginx.rules.in b/debian/nginx.rules.in
index afa208b..e2ef3b4 100755
--- a/debian/nginx.rules.in
+++ b/debian/nginx.rules.in
@@ -2,6 +2,8 @@
 
 #export DH_VERBOSE=1
 export DEB_BUILD_MAINT_OPTIONS=hardening=+all,-pie
+export DEB_CFLAGS_MAINT_APPEND=-Wp,-D_FORTIFY_SOURCE=2 -fPIC
+export DEB_LDFLAGS_MAINT_APPEND=-Wl,--as-needed -pie
 DPKG_EXPORT_BUILDFLAGS = 1
 include /usr/share/dpkg/buildflags.mk
 

rpm/SPECS/nginx-module.spec.in

diff --git a/rpm/SPECS/nginx-module.spec.in b/rpm/SPECS/nginx-module.spec.in
index b6a278d..2d07334 100644
--- a/rpm/SPECS/nginx-module.spec.in
+++ b/rpm/SPECS/nginx-module.spec.in
@@ -53,6 +53,7 @@
 %endif
 
 %define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags))
+%define WITH_LD_OPT -Wl,-z,relro -Wl,-z,now
 
 %define BASE_CONFIGURE_ARGS $(echo "%%BASE_CONFIGURE_ARGS%%")
 %define MODULE_CONFIGURE_ARGS $(echo "%%MODULE_CONFIGURE_ARGS%%")
@@ -68,6 +69,7 @@
 cd %{bdir}
 ./configure %{BASE_CONFIGURE_ARGS} %{MODULE_CONFIGURE_ARGS} \
 	--with-cc-opt="%{WITH_CC_OPT}" \
+	--with-ld-opt="%{WITH_LD_OPT}" \
 	--with-debug
 make %{?_smp_mflags} modules
 for so in `find %{bdir}/objs/ -type f -name "*.so"`; do
@@ -75,7 +77,8 @@
 mv $so $debugso
 done
 ./configure %{BASE_CONFIGURE_ARGS} %{MODULE_CONFIGURE_ARGS} \
-	--with-cc-opt="%{WITH_CC_OPT}"
+	--with-cc-opt="%{WITH_CC_OPT}" \
+	--with-ld-opt="%{WITH_LD_OPT}"
 make %{?_smp_mflags} modules
 
 %install

rpm/SPECS/nginx.spec.in

diff --git a/rpm/SPECS/nginx.spec.in b/rpm/SPECS/nginx.spec.in
index c73ea51..26bee95 100644
--- a/rpm/SPECS/nginx.spec.in
+++ b/rpm/SPECS/nginx.spec.in
@@ -52,7 +52,8 @@
 
 %define bdir %{_builddir}/%{name}-%{main_version}
 
-%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags))
+%define WITH_CC_OPT $(echo %{optflags} $(pcre-config --cflags)) -fPIC
+%define WITH_LD_OPT -Wl,-z,relro -Wl,-z,now -pie
 
 %define BASE_CONFIGURE_ARGS $(echo "%%BASE_CONFIGURE_ARGS%%")
 
@@ -105,12 +106,14 @@
 %build
 ./configure %{BASE_CONFIGURE_ARGS} \
     --with-cc-opt="%{WITH_CC_OPT}" \
+    --with-ld-opt="%{WITH_LD_OPT}" \
     --with-debug
 make %{?_smp_mflags}
 %{__mv} %{bdir}/objs/nginx \
     %{bdir}/objs/nginx-debug
 ./configure %{BASE_CONFIGURE_ARGS} \
-    --with-cc-opt="%{WITH_CC_OPT}"
+    --with-cc-opt="%{WITH_CC_OPT}" \
+    --with-ld-opt="%{WITH_LD_OPT}"
 make %{?_smp_mflags}
 
 %install