@ -620,7 +620,7 @@ else()
add_cxx_flag_if_supported ( -Wformat-security CXX_SECURITY_FLAGS )
# - f s t a c k - p r o t e c t o r
if ( NOT WIN32 AND NOT OPENBSD )
if ( NOT OPENBSD AND NOT ( WIN32 AND ( CMAKE_C_COMPILER_ID STREQUAL "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_LESS 9.1 ) ) )
add_c_flag_if_supported ( -fstack-protector C_SECURITY_FLAGS )
add_cxx_flag_if_supported ( -fstack-protector CXX_SECURITY_FLAGS )
add_c_flag_if_supported ( -fstack-protector-strong C_SECURITY_FLAGS )
@ -628,9 +628,11 @@ else()
endif ( )
# N e w i n G C C 8 . 2
if ( NOT WIN32 AND NOT OPENBSD )
if ( NOT OPENBSD AND NOT ( WIN32 AND ( CMAKE_C_COMPILER_ID STREQUAL "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_LESS 9.1 ) ) )
add_c_flag_if_supported ( -fcf-protection=full C_SECURITY_FLAGS )
add_cxx_flag_if_supported ( -fcf-protection=full CXX_SECURITY_FLAGS )
endif ( )
if ( NOT WIN32 AND NOT OPENBSD )
add_c_flag_if_supported ( -fstack-clash-protection C_SECURITY_FLAGS )
add_cxx_flag_if_supported ( -fstack-clash-protection CXX_SECURITY_FLAGS )
endif ( )
@ -642,8 +644,8 @@ else()
endif ( )
# l i n k e r
if ( NOT WIN32 )
# W i n d o w s b i n a r i e s d i e o n s t a r t u p w i t h P I E
if ( NOT ( WIN32 AND ( CMAKE_C_COMPILER_ID STREQUAL "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_LESS 9.1 ) ) )
# W i n d o w s b i n a r i e s d i e o n s t a r t u p w i t h P I E w h e n c o m p i l e d w i t h G C C < 9 . x
add_linker_flag_if_supported ( -pie LD_SECURITY_FLAGS )
endif ( )
add_linker_flag_if_supported ( -Wl,-z,relro LD_SECURITY_FLAGS )
@ -667,6 +669,7 @@ else()
if ( WIN32 )
add_linker_flag_if_supported ( -Wl,--dynamicbase LD_SECURITY_FLAGS )
add_linker_flag_if_supported ( -Wl,--nxcompat LD_SECURITY_FLAGS )
add_linker_flag_if_supported ( -Wl,--high-entropy-va LD_SECURITY_FLAGS )
endif ( )
message ( STATUS "Using C security hardening flags: ${C_SECURITY_FLAGS}" )