From 49975380c5a6ffeceffe0e002a9a63171145053e Mon Sep 17 00:00:00 2001
From: zhangsong <zhangsong34@huawei.com>
Date: Fri, 29 Jan 2021 11:31:06 +0800
Subject: [PATCH] syscontainer-tools: build security option
Signed-off-by: zhangsong <zhangsong34@huawei.com>
---
Makefile | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/Makefile b/Makefile
index 4b3af7d..b7c45b2 100644
--- a/Makefile
+++ b/Makefile
@@ -20,8 +20,13 @@ VERSION := $(shell cat ./VERSION)
BEP_DIR=/tmp/syscontainer-tools-build-bep
BEP_FLAGS=-tmpdir=/tmp/syscontainer-tools-build-bep
-GO_LDFLAGS="-w -buildid=IdByiSula -extldflags -static $(BEP_FLAGS) -X main.gitCommit=${COMMIT} -X main.version=${VERSION}"
-ENV = GOPATH=${GOPATH} CGO_ENABLED=1
+GO_LDFLAGS="-buildid=IdByiSula $(BEP_FLAGS) -extldflags=-static -extldflags=-Wl,-z,relro,-z,now -X main.gitCommit=${COMMIT} -X main.version=${VERSION}"
+
+ENV = GOPATH=${GOPATH} \
+ CGO_ENABLED=1 \
+ CGO_CFLAGS="-fstack-protector-strong -fPIE" \
+ CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \
+ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack"
## PLEASE be noticed that the vendor dir can only work with golang > 1.6 !!
@@ -34,12 +39,12 @@ init:
syscontainer-tools: $(SOURCES) | $(DEPS_LINK)
@echo "Making syscontainer-tools..."
- ${ENV} go build -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-tools .
+ ${ENV} go build -buildmode=pie -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-tools .
@echo "Done!"
syscontainer-hooks: $(SOURCES) | $(DEPS_LINK)
@echo "Making syscontainer-hooks..."
- ${ENV} go build -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-hooks ./hooks/syscontainer-hooks
+ ${ENV} go build -buildmode=pie -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-hooks ./hooks/syscontainer-hooks
@echo "Done!"
localtest:
--
1.8.3.1