diff --git a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md index cfb28ce0..ccf29384 100644 --- a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md +++ b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md @@ -1371,6 +1371,26 @@ If you are compiling a C/C++ compiler, where practical make the generated compil | `--enable-host-bind-now` | GCC 14.0.0 | Build the compiler executables with [`-Wl,-z,now`](#-Wl,-z,now) | | `CLANG_DEFAULT_PIE_ON_LINUX` | Clang 14.0.0 | Turn on [`-fPIE`](#-fPIE_-pie) and [`-pie`](#-fPIE_-pie) by default for binaries produced by the compiler | +## What should you do when compiling linkers? + +If you are compiling a linker, where practical make the generated linker's default options the *secure* options. The below table summarizes relevant options that can be specifed when building GNU Binutils that affect the defaults of the linker: + +| Linker Flag | Supported since | Description | +|:--- |:---:|:---- | +| `--disable-default-execstack` | Binutils 2.42 | Require the `GNU_STACK` ELF note for executable stacks, rather than enabling it by default. | +| `--enable-warn-execstack` | Binutils 2.42 | Warn if an executable stack is requested with `GNU_STACK`. | +| `--enable-error-execstack` | Binutils 2.42 | Error out if an executable stack is requested, even with `GNU_STACK`. | +| `--enable-warn-rwx-segments` | Binutils 2.42 | Warn if a segment has unsafe permissions. | +| `--enable-error-rwx-segments` | Binutils 2.42 | Error out if a segment has unsafe permissions. | +| `--enable-relro` | Binutils 2.27 | Default to passing `-Wl,-z,relro`. | +| `--enable-textrel-check=` | Binutils 2.35 | Controls whether TEXTRELs are fatal errors (`=error`), warnings (`=warn`), or ignored (`=no`). | + +Some background on the introduction of these options to GNU Binutils is available from Nick Clifton, its Chief Maintainer[^Clifton22]. + +Note that LLVM recommends using Clang configuration files to pass the relevant options to the linker via the compiler driver, so no such options exist here. + +[^Clifton22]: Clifton, Nick, [The linker’s warnings about executable stacks and segments](https://www.redhat.com/en/blog/linkers-warnings-about-executable-stacks-and-segments), Red Hat Blog, 2022-09-14. + ## Contributors The OpenSSF Developer BEST Practices Working group thanks Ericsson for their generous initial donation of content to start collaboration on this guide.