Skip to content

Commit 847f504

Browse files
mhduiydeepin-bot[bot]
authored andcommitted
fix: add hardening compiler flags for Debian build
1. Added DEB_CFLAGS_MAINT_APPEND with -Wall for C compiler warnings 2. Added DEB_CXXFLAGS_MAINT_APPEND with -Wall for C++ compiler warnings 3. Added DEB_LDFLAGS_MAINT_APPEND with multiple security hardening flags: - --as-needed for linking only required libraries - -z,relro for read-only relocation sections - -z,now for immediate binding - -z,noexecstack for non-executable stacks - -E for exporting symbols 4. These changes improve security and catch potential issues during compilation fix: 为 Debian 构建添加强化编译选项 1. 为 C 编译器添加 DEB_CFLAGS_MAINT_APPEND 包含 -Wall 警告选项 2. 为 C++ 编译器添加 DEB_CXXFLAGS_MAINT_APPEND 包含 -Wall 警告选项 3. 为链接器添加 DEB_LDFLAGS_MAINT_APPEND 包含多个安全强化选项: - --as-needed 仅链接需要的库 - -z,relro 设置只读重定位段 - -z,now 启用立即绑定 - -z,noexecstack 禁用可执行栈 - -E 导出符号 4. 这些变更提高了安全性并在编译时捕获潜在问题
1 parent f19d7d2 commit 847f504

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

debian/rules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ export QT_SELECT=5
44

55
# see FEATURE AREAS in dpkg-buildflags(1)
66
export DEB_BUILD_MAINT_OPTIONS = hardening=+all
7+
export DEB_CFLAGS_MAINT_APPEND = -Wall
8+
export DEB_CXXFLAGS_MAINT_APPEND = -Wall
9+
export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-E
710

811
# see ENVIRONMENT in dpkg-buildflags(1)
912
# package maintainers to append CFLAGS

0 commit comments

Comments
 (0)