commit b8f40c83dad67a6a4e41d723e28b75641eae537c
parent 86a95111dc0c29fcd58c747cec3cd49725c6af12
Author: Christian Grothoff <christian@grothoff.org>
Date: Wed, 29 Jul 2026 18:58:46 +0200
add an enable-hardening build option, on by default
Diffstat:
2 files changed, 42 insertions(+), 0 deletions(-)
diff --git a/meson.build b/meson.build
@@ -4,6 +4,9 @@ project(
license: 'AGPLv3',
meson_version: '>=1.1.0',
version: run_command('sh', 'scripts/get_version.sh', check: true).stdout().strip(),
+ # PIE is a built-in option, so it has to be set here rather than under the
+ # 'hardening' option below; -Db_pie=false still turns it off.
+ default_options: ['b_pie=true'],
)
cc = meson.get_compiler('c')
@@ -54,6 +57,44 @@ if not get_option('only-doc')
'-Wno-address-of-packed-member',
language: 'c',
)
+
+ # Source builds get no hardening from anywhere else: distribution packaging
+ # passes its own flags, but ./configure && make does not. For a key backup
+ # tool that is worth having on by default.
+ if get_option('hardening')
+ hardening_cflags = cc.get_supported_arguments(
+ '-fstack-protector-strong',
+ '-fstack-clash-protection',
+ )
+ # _FORTIFY_SOURCE needs optimisation to do anything and warns without
+ # it, so only set it when the build is actually optimised.
+ if get_option('optimization') not in ['0', 'g']
+ if cc.compiles(
+ '''#include <string.h>
+ #if __has_include(<features.h>)
+ #include <features.h>
+ #endif
+ #if _FORTIFY_SOURCE < 3
+ #error no level 3
+ #endif
+ int main(void) { return 0; }''',
+ args: ['-O2', '-D_FORTIFY_SOURCE=3'],
+ name: '_FORTIFY_SOURCE=3',
+ )
+ hardening_cflags += '-D_FORTIFY_SOURCE=3'
+ else
+ hardening_cflags += '-D_FORTIFY_SOURCE=2'
+ endif
+ endif
+ add_project_arguments(hardening_cflags, language: 'c')
+ add_project_link_arguments(
+ cc.get_supported_link_arguments(
+ '-Wl,-z,relro',
+ '-Wl,-z,now',
+ ),
+ language: 'c',
+ )
+ endif
taler_lib_ldflags = '-export-dynamic -no-undefined'
check_headers = ['stdint.h', 'stdlib.h', 'string.h', 'unistd.h']
diff --git a/meson.options b/meson.options
@@ -3,3 +3,4 @@ option('only-doc', type : 'boolean', value : false, description: 'whether to com
option('disable-doc', type : 'boolean', value : false, description: 'whether to disable documentation')
option('install-rpath', type : 'boolean', value : false, description: 'Add rpath to installed binaries if set')
option('logging', type : 'string', value: 'yes', description: 'Log setting. Can be set to "yes" (logging, default), "no" (no logging), "verbose" (extra logging"), "veryverbose" (even more logging)')
+option('hardening', type : 'boolean', value : true, description: 'Build with PIE, RELRO/BIND_NOW, _FORTIFY_SOURCE and stack protector (disable for profiling or debugging)')
