makefiles: stop overriding CFLAGS/LDFLAGS

From the manual of GNU Automake (version 1.16.5)[1] [2]:

> 3.6 Variables reserved for the user
>
> Some `Makefile` variables are reserved by the GNU Coding Standards for
> the use of the "user"—the person building the package.  For instance,
> `CFLAGS` is one such variable.
>
>    Sometimes package developers are tempted to set user variables such
> as `CFLAGS` because it appears to make their job easier.  However, the
> package itself should never set a user variable, particularly not to
> include switches that are required for proper compilation of the
> package.  Since these variables are documented as being for the
> package builder, that person rightfully expects to be able to override
> any of these variables at build time.
>
>    To get around this problem, Automake introduces an
> automake-specific shadow variable for each user flag variable.
> (Shadow variables are not introduced for variables like `CC`, where
> they would make no sense.) The shadow variable is named by prepending
> `AM_` to the user variable's name.  For instance, the shadow variable
> for `YFLAGS` is `AM_YFLAGS`.  The package maintainer—that is, the
> author(s) of the `Makefile.am` and `configure.ac` files—may adjust
> these shadow variables however necessary.
>
>    Note Flag Variables Ordering::, for more discussion about these
> variables and how they interact with per-target variables.

See also the description of CFLAGS in the GNU Autoconf manual[3].

Note: We do not use automake (save for aclocal) nor generally follow the
GNU Coding Standards, but the concept still applies.  Also, the closest
analogous in the project to the `AM_` prefix would currently likely be
`EXTRA_`.

[1] https://www.gnu.org/software/automake/manual/1.16.5/html_node/User-Variables.html
[2] https://www.gnu.org/software/automake/manual/1.16.5/html_node/Flag-Variables-Ordering.html
[3] https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Preset-Output-Variables.html

config.mk.in

@@ -51,9 +51,14 @@ HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
 
 MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 
+# User variables - should not be modified in the code (as they are reserved for
+# the user building the package); see the following for details:
+# https://www.gnu.org/software/automake/manual/1.16.5/html_node/User-Variables.html
 CC=@CC@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
+
+# Project variables
 LIBS=@LIBS@
 
 ifdef NO_EXTRA_CFLAGS

src/prog.mk

@@ -9,25 +9,26 @@ HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS)
 SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS)
 OBJS := $(SRCS:.c=.o) $(MOD_OBJS)
 
-CFLAGS += \
+PROG_CFLAGS = \
 	-ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \
 	-fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \
 	-fPIE \
 	-DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' \
 	-DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' \
 	-DVARDIR='"/var/lib/firejail"' \
-	$(HAVE_GCOV) $(MANFLAGS)
+	$(HAVE_GCOV) $(MANFLAGS) \
+	$(EXTRA_CFLAGS)
 
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
+PROG_LDFLAGS = -pie -fPIE -Wl,-z,relro -Wl,-z,now $(EXTRA_LDFLAGS)
 
 .PHONY: all
 all: $(TARGET)
 
 %.o : %.c $(HDRS) $(ROOT)/config.mk
-	$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+	$(CC) $(PROG_CFLAGS) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
 $(PROG): $(OBJS) $(ROOT)/config.mk
-	$(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+	$(CC) $(PROG_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
 
 .PHONY: clean
 clean:; rm -fr *.o $(PROG) *.gcov *.gcda *.gcno *.plist $(TOCLEAN)

src/so.mk

@@ -9,21 +9,21 @@ HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS)
 SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS)
 OBJS := $(SRCS:.c=.o) $(MOD_OBJS)
 
-CFLAGS += \
+SO_CFLAGS = \
 	-ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \
 	-fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \
 	-fPIC
 
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
+SO_LDFLAGS = -pie -fPIE -Wl,-z,relro -Wl,-z,now
 
 .PHONY: all
 all: $(TARGET)
 
 %.o : %.c $(HDRS) $(ROOT)/config.mk
-	$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+	$(CC) $(SO_CFLAGS) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
 $(SO): $(OBJS) $(ROOT)/config.mk
-	$(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl
+	$(CC) $(SO_LDFLAGS) -shared -fPIC -z relro $(LDFLAGS) -o $@ $(OBJS) -ldl
 
 .PHONY: clean
 clean:; rm -fr $(OBJS) $(SO) *.plist $(TOCLEAN)