generated from ossf/project-template
-
Notifications
You must be signed in to change notification settings - Fork 133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Consider -Wl,-z,separate-code
for C and C++ Compiler Hardening Guide
#588
Comments
Some notes:
|
thesamesam
added a commit
to thesamesam/wg-best-practices-os-developers
that referenced
this issue
Sep 22, 2024
…nfiguration options Add a section similar to "What should you do when compiling compilers?" but for linkers. LLVM doesn't accept new configure (CMake) options for default behaviour like this and instead asks distributors to use Clang configuration files, so this section is (currently) only for GNU Binutils. Per ossf#588, I've not included separate-code/rosegment, as we should handle that separately once there is consensus. Closes: ossf#623 Signed-off-by: Sam James <[email protected]>
thesamesam
added a commit
to thesamesam/wg-best-practices-os-developers
that referenced
this issue
Oct 4, 2024
…nfiguration options Add a section similar to "What should you do when compiling compilers?" but for linkers. LLVM doesn't accept new configure (CMake) options for default behaviour like this and instead asks distributors to use Clang configuration files, so this section is (currently) only for GNU Binutils. Per ossf#588, I've not included separate-code/rosegment, as we should handle that separately once there is consensus. Closes: ossf#623 Signed-off-by: Sam James <[email protected]>
thomasnyman
pushed a commit
that referenced
this issue
Oct 4, 2024
…nfiguration options Add a section similar to "What should you do when compiling compilers?" but for linkers. LLVM doesn't accept new configure (CMake) options for default behaviour like this and instead asks distributors to use Clang configuration files, so this section is (currently) only for GNU Binutils. Per #588, I've not included separate-code/rosegment, as we should handle that separately once there is consensus. Closes: #623 Signed-off-by: Sam James <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Splitting this off from Dominik Czarnota's extensive feedback in #330.
The
-Wl,-z,separate-code
option ensures that the ELF header is not mapped with executable rights. This is effectively a complement to RELRO but instead of applying read-only permissions to sensitive parts of the data segment, it applies read-only permissions to potentially dangerous areas of the code segment.Resources:
The text was updated successfully, but these errors were encountered: