5 files changed, 33 insertions, 15 deletions

diff --git a/config.mk.in b/config.mk.in
index 9973b7eaa..cfef6b8d3 100644
--- a/config.mk.in
+++ b/config.mk.in
@@ -51,8 +51,15 @@ HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
 
 MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 
+# User variables - should not be modified in the code (as they are reserved for
+# the user building the package); see the following for details:
+# https://www.gnu.org/software/automake/manual/1.16.5/html_node/User-Variables.html
 CC=@CC@
 CFLAGS=@CFLAGS@
+LDFLAGS=@LDFLAGS@
+
+# Project variables
+LIBS=@LIBS@
 
 ifdef NO_EXTRA_CFLAGS
 else
diff --git a/configure b/configure
index 4c9ed1a36..1b827922d 100755
--- a/configure
+++ b/configure
@@ -3334,7 +3334,7 @@ else
 $as_echo "yes" >&6; }
 
                 EXTRA_CFLAGS="$EXTRA_CFLAGS $AA_CFLAGS"
-                EXTRA_LDFLAGS="$EXTRA_LDFLAGS $AA_LIBS"
+                LIBS="$LIBS $AA_LIBS"
 
 fi
 
@@ -3350,7 +3350,7 @@ fi
 if test "x$enable_selinux" = "xyes"; then :
 
         HAVE_SELINUX="-DHAVE_SELINUX"
-        EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lselinux"
+        LIBS="$LIBS -lselinux"
 
 fi
 
@@ -3612,7 +3612,8 @@ fi
 if test "x$enable_gcov" = "xyes"; then :
 
         HAVE_GCOV="--coverage -DHAVE_GCOV"
-        EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lgcov --coverage"
+        EXTRA_LDFLAGS="$EXTRA_LDFLAGS --coverage"
+        LIBS="$LIBS -lgcov"
 
 fi
 
@@ -5258,8 +5259,12 @@ fi
 cat <<EOF
 
 Compile options:
+   CC: $CC
+   CFLAGS: $CFLAGS
+   LDFLAGS: $LDFLAGS
    EXTRA_CFLAGS: $EXTRA_CFLAGS
    EXTRA_LDFLAGS: $EXTRA_LDFLAGS
+   LIBS: $LIBS
    fatal warnings: $HAVE_FATAL_WARNINGS
    gcov instrumentation: $HAVE_GCOV
    install as a SUID executable: $HAVE_SUID
diff --git a/configure.ac b/configure.ac
index e418b72bc..556019232 100644
--- a/configure.ac
+++ b/configure.ac
@@ -72,7 +72,7 @@ AS_IF([test "x$enable_apparmor" = "xyes"], [
         HAVE_APPARMOR="-DHAVE_APPARMOR"
         PKG_CHECK_MODULES([AA], [libapparmor], [
                 EXTRA_CFLAGS="$EXTRA_CFLAGS $AA_CFLAGS"
-                EXTRA_LDFLAGS="$EXTRA_LDFLAGS $AA_LIBS"
+                LIBS="$LIBS $AA_LIBS"
         ])
 ])
 
@@ -82,7 +82,7 @@ AC_ARG_ENABLE([selinux],
     [AS_HELP_STRING([--enable-selinux], [SELinux labeling support])])
 AS_IF([test "x$enable_selinux" = "xyes"], [
         HAVE_SELINUX="-DHAVE_SELINUX"
-        EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lselinux"
+        LIBS="$LIBS -lselinux"
 ])
 
 AC_SUBST([EXTRA_CFLAGS])
@@ -226,7 +226,8 @@ AC_ARG_ENABLE([gcov],
     [AS_HELP_STRING([--enable-gcov], [Gcov instrumentation])])
 AS_IF([test "x$enable_gcov" = "xyes"], [
         HAVE_GCOV="--coverage -DHAVE_GCOV"
-        EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lgcov --coverage"
+        EXTRA_LDFLAGS="$EXTRA_LDFLAGS --coverage"
+        LIBS="$LIBS -lgcov"
 ])
 
 HAVE_CONTRIB_INSTALL="yes"
@@ -291,8 +292,12 @@ AC_OUTPUT
 cat <<EOF
 
 Compile options:
+   CC: $CC
+   CFLAGS: $CFLAGS
+   LDFLAGS: $LDFLAGS
    EXTRA_CFLAGS: $EXTRA_CFLAGS
    EXTRA_LDFLAGS: $EXTRA_LDFLAGS
+   LIBS: $LIBS
    fatal warnings: $HAVE_FATAL_WARNINGS
    gcov instrumentation: $HAVE_GCOV
    install as a SUID executable: $HAVE_SUID
diff --git a/src/prog.mk b/src/prog.mk
index 84f43142d..b2ccf6147 100644
--- a/src/prog.mk
+++ b/src/prog.mk
@@ -9,25 +9,26 @@ HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS)
 SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS)
 OBJS := $(SRCS:.c=.o) $(MOD_OBJS)
 
-CFLAGS += \
+PROG_CFLAGS = \
         -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \
         -fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \
         -fPIE \
         -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' \
         -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' \
         -DVARDIR='"/var/lib/firejail"' \
-        $(HAVE_GCOV) $(MANFLAGS)
+        $(HAVE_GCOV) $(MANFLAGS) \
+        $(EXTRA_CFLAGS)
 
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
+PROG_LDFLAGS = -pie -fPIE -Wl,-z,relro -Wl,-z,now $(EXTRA_LDFLAGS)
 
 .PHONY: all
 all: $(TARGET)
 
 %.o : %.c $(HDRS) $(ROOT)/config.mk
-        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(PROG_CFLAGS) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
 $(PROG): $(OBJS) $(ROOT)/config.mk
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+        $(CC) $(PROG_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
 
 .PHONY: clean
 clean:; rm -fr *.o $(PROG) *.gcov *.gcda *.gcno *.plist $(TOCLEAN)
diff --git a/src/so.mk b/src/so.mk
index 10c43ad21..28bd229e5 100644
--- a/src/so.mk
+++ b/src/so.mk
@@ -9,21 +9,21 @@ HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS)
 SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS)
 OBJS := $(SRCS:.c=.o) $(MOD_OBJS)
 
-CFLAGS += \
+SO_CFLAGS = \
         -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \
         -fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \
         -fPIC
 
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
+SO_LDFLAGS = -pie -fPIE -Wl,-z,relro -Wl,-z,now
 
 .PHONY: all
 all: $(TARGET)
 
 %.o : %.c $(HDRS) $(ROOT)/config.mk
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(SO_CFLAGS) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
 $(SO): $(OBJS) $(ROOT)/config.mk
-        $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl
+        $(CC) $(SO_LDFLAGS) -shared -fPIC -z relro $(LDFLAGS) -o $@ $(OBJS) -ldl
 
 .PHONY: clean
 clean:; rm -fr $(OBJS) $(SO) *.plist $(TOCLEAN)