49 lines
1.9 KiB
Diff
49 lines
1.9 KiB
Diff
|
From 49975380c5a6ffeceffe0e002a9a63171145053e Mon Sep 17 00:00:00 2001
|
||
|
|
From: zhangsong <zhangsong34@huawei.com>
|
||
|
|
Date: Fri, 29 Jan 2021 11:31:06 +0800
|
||
|
|
Subject: [PATCH] syscontainer-tools: build security option
|
||
|
|
|
||
|
|
Signed-off-by: zhangsong <zhangsong34@huawei.com>
|
||
|
|
---
|
||
|
|
Makefile | 13 +++++++++----
|
||
|
|
1 file changed, 9 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/Makefile b/Makefile
|
||
|
|
index 4b3af7d..b7c45b2 100644
|
||
|
|
--- a/Makefile
|
||
|
|
+++ b/Makefile
|
||
|
|
@@ -20,8 +20,13 @@ VERSION := $(shell cat ./VERSION)
|
||
|
|
BEP_DIR=/tmp/syscontainer-tools-build-bep
|
||
|
|
BEP_FLAGS=-tmpdir=/tmp/syscontainer-tools-build-bep
|
||
|
|
|
||
|
|
-GO_LDFLAGS="-w -buildid=IdByiSula -extldflags -static $(BEP_FLAGS) -X main.gitCommit=${COMMIT} -X main.version=${VERSION}"
|
||
|
|
-ENV = GOPATH=${GOPATH} CGO_ENABLED=1
|
||
|
|
+GO_LDFLAGS="-buildid=IdByiSula $(BEP_FLAGS) -extldflags=-static -extldflags=-Wl,-z,relro,-z,now -X main.gitCommit=${COMMIT} -X main.version=${VERSION}"
|
||
|
|
+
|
||
|
|
+ENV = GOPATH=${GOPATH} \
|
||
|
|
+ CGO_ENABLED=1 \
|
||
|
|
+ CGO_CFLAGS="-fstack-protector-strong -fPIE" \
|
||
|
|
+ CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \
|
||
|
|
+ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack"
|
||
|
|
|
||
|
|
## PLEASE be noticed that the vendor dir can only work with golang > 1.6 !!
|
||
|
|
|
||
|
|
@@ -34,12 +39,12 @@ init:
|
||
|
|
|
||
|
|
syscontainer-tools: $(SOURCES) | $(DEPS_LINK)
|
||
|
|
@echo "Making syscontainer-tools..."
|
||
|
|
- ${ENV} go build -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-tools .
|
||
|
|
+ ${ENV} go build -buildmode=pie -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-tools .
|
||
|
|
@echo "Done!"
|
||
|
|
|
||
|
|
syscontainer-hooks: $(SOURCES) | $(DEPS_LINK)
|
||
|
|
@echo "Making syscontainer-hooks..."
|
||
|
|
- ${ENV} go build -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-hooks ./hooks/syscontainer-hooks
|
||
|
|
+ ${ENV} go build -buildmode=pie -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-hooks ./hooks/syscontainer-hooks
|
||
|
|
@echo "Done!"
|
||
|
|
|
||
|
|
localtest:
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|