socat: hardening with Canary, PIE, Full RELRO and FORTIFY_SOURCE

[arno01]

# checksec --proc socat
         COMMAND    PID RELRO             STACK CANARY           NX/PaX        PIE
           socat  13035 Full RELRO        Canary found           NX enabled    PIE enabled 

[peti]

Won't these changes break the build on non-Linux / non-gcc platforms?

[arno01]

Based on https://wiki.debian.org/Hardening#DEB_BUILD_HARDENING_PIE_.28gcc.2Fg.2B-.2B-_-fPIE_-pie.29

-fPIE -pie

Doesn't work on hppa and m68k (disabled for these archs by default in hardening-wrapper 1.6)
Doesn't work on some assembler, due to lack of registers. e.g.:

vf_decimate.c:26: error: can't find a register in class 'BREG' while reloading 'asm'

ld -z relro

    Unimplemented on ia64 (ld silently ignores the option). 

ld -z now
seems to be OK

Canaries (-fstack-protector)

Not supported on ia64 and alpha. (disabled for these archs by default in hardening-wrapper 1.8)

warning: -fstack-protector not supported for this target
Not supported on mips and hppa. (disabled for these archs by default in hardening-wrapper 1.10)

warning: -fstack-protector not supported for this target

-D_FORTIFY_SOURCE=2

    Code compiled with -Werror and using memcpy/strcpy with qualifier overrides will fail with FORTIFY enabled. See https://launchpad.net/bugs/217481 

[peti]

How about Darwin, which uses clang instead of gcc to compile?

[arno01]

@peti I've no idea to be honest about Darwin. Perhaps, there is someone who would know it for sure :)

[spwhitt]

This does cause a failure when building with clang. You can simply change to the following:

preConfigure = if (stdenv.cc.cc.isGNU or false) then ''
  ...
'' else null;

Which will only apply the flags if we're compiling with gcc.

[fpletz]

Closing in favor of #12895.