Skip to content
  • Robert Edmonds's avatar
    debian/rules: Enable build hardening · 4485ac90
    Robert Edmonds authored
    Per lintian:
    
    I: libprotobuf-c1: hardening-no-bindnow usr/lib/x86_64-linux-gnu/libprotobuf-c.so.1.0.0
    
    I: protobuf-c-compiler: hardening-no-bindnow usr/bin/protoc-gen-c
    
    N:
    N:    This package provides an ELF binary that lacks the "bindnow" linker
    N:    flag.
    N:
    N:    This is needed (together with "relro") to make the "Global Offset Table"
    N:    (GOT) fully read-only. The bindnow feature trades startup time for
    N:    improved security. Please consider enabling this feature or consider
    N:    overriding the tag (possibly with a comment about why).
    N:
    N:    If you use dpkg-buildflags, you may have to add hardening=+bindnow or
    N:    hardening=+all to DEB_BUILD_MAINT_OPTIONS.
    N:
    N:    The relevant compiler flags are set in LDFLAGS.
    N:
    N:    Refer to https://wiki.debian.org/Hardening for details.
    N:
    N:    Severity: wishlist, Certainty: certain
    N:
    N:    Check: binaries, Type: binary, udeb
    N:
    4485ac90
Loading