Add extra build flags to CMakeLists.txt. (#16641)
* Add stack-protector flag handling. * Add stack clash protection flag. * Add CFI flag * Only add flags that are not already in the compiler flags. * Add branch protection flag. * Add fortify source options. * Add function/data section flags. * Fix inclusion of hardening flags. Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud> --------- Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>
Austin S. Hemmelgarn committed
Jan 4, 2024 at 08:30 UTC
b536fef45cc6f7726289e106077c2f9388d72940
1 file changed
+85
CMakeLists.txt
+85
@@ -108,6 +108,91 @@ option(ENABLE_BUNDLED_PROTOBUF "enable bundled protobuf" False)
108
109
option(ENABLE_LOGS_MANAGEMENT_TESTS "enable logs management tests" True)
110
111
+#
112
+# handling of extra compiler flags
113
+#
114
+
115
+include(CheckCCompilerFlag)
116
+
117
+option(DISABLE_HARDENING "disable adding extra compiler flags for hardening" False)
118
+
119
+set(EXTRA_HARDENING_FLAGS "")
120
+
121
+if(NOT ${DISABLE_HARDENING})
122
+ if(NOT ${CMAKE_C_FLAGS} MATCHES "stack-protector")
123
+ check_c_compiler_flag("-fstack-protector-strong" HAVE_STACK_PROTECTOR_STRONG_FLAG)
124
+ if(HAVE_STACK_PROTECTOR_STRONG_FLAG)
125
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -fstack-protector-strong")
126
+ else()
127
+ check_c_compiler_flag("-fstack-protector" HAVE_STACK_PROTECTOR)
128
+ if(HAVE_STACK_PROTECTOR)
129
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -fstack-protector")
130
+ endif()
131
+ endif()
132
+ endif()
133
+
134
+ if(NOT ${CMAKE_C_FLAGS} MATCHES "stack-clash-protection")
135
+ check_c_compiler_flag("-fstack-clash-protection", HAVE_STACK_CLASH_FLAG)
136
+ if(HAVE_STACK_CLASH_FLAG)
137
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -fstack-clash-protection")
138
+ endif()
139
+ endif()
140
+
141
+ if(NOT ${CMAKE_C_FLAGS} MATCHES "-fcf-protection")
142
+ check_c_compiler_flag("-fcf-protection=full" HAVE_CFI_FLAG)
143
+ if(HAVE_CFI_FLAG)
144
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -fcf-protection=full")
145
+ endif()
146
+ endif()
147
+
148
+ if(NOT ${CMAKE_C_FLAGS} MATCHES "branch-protection")
149
+ check_c_compiler_flag("-mbranch-protection=standard" HAVE_BRANCH_PROT_FLAG)
150
+ if(HAVE_BRANCH_PROT_FLAG)
151
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -mbranch-protection=standard")
152
+ endif()
153
+ endif()
154
+
155
+ if(NOT ${CMAKE_C_FLAGS} MATCHES "_FORTIFY_SOURCE")
156
+ check_c_compiler_flag("-D_FORTIFY_SOURCE=3" HAVE_FORTIFY_SOURCE_3)
157
+ if(HAVE_FORTIFY_SOURCE_3)
158
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -D_FRTIFY_SOURCE=3")
159
+ else()
160
+ check_c_compiler_flag("-D_FORTIFY_SOURCE=2" HAVE_FORTIFY_SOURCE_2)
161
+ if(HAVE_FORTIFY_SOURCE_2)
162
+ set(EXTRA_HARDENING_FLAGS "${EXTRA_HARDENING_FLAGS} -D_FRTIFY_SOURCE=2")
163
+ endif()
164
+ endif()
165
+ endif()
166
+endif()
167
+
168
+set(EXTRA_OPT_FLAGS "")
169
+
170
+if(NOT ${CMAKE_C_FLAGS} MATCHES "function-sections")
171
+ check_c_compiler_flag("-ffunction-sections" HAVE_FUNCTION_SECTIONS)
172
+ if(HAVE_FUNCTION_SECTIONS)
173
+ set(EXTRA_OPT_FLAGS "${EXTRA_OPT_FLAGS} -ffunction-sections")
174
+ endif()
175
+endif()
176
+
177
+if(NOT ${CMAKE_C_FLAGS} MATCHES "data-sections")
178
+ check_c_compiler_flag("-fdata-sections" HAVE_DATA_SECTIONS)
179
+ if(HAVE_DATA_SECTIONS)
180
+ set(EXTRA_OPT_FLAGS "${EXTRA_OPT_FLAGS} -fdata-sections")
181
+ endif()
182
+endif()
183
+
184
+set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
185
+set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
186
+
187
+set(CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
188
+set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
189
+
190
+set(CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
191
+set(CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
192
+
193
+set(CMAKE_C_FLAGS_MINSIZEREL "${CMAKE_C_FLAGS_MINSIZEREL} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
194
+set(CMAKE_CXX_FLAGS_MINSIZEREL "${CMAKE_CXX_FLAGS_MINSIZEREL} ${EXTRA_HARDENING_FLAGS} ${EXTRA_OPT_FLAGS}")
195
+
196
#
197
# detect OS
198
#