3 files changed, 15 insertions, 9 deletions

diff --git a/config.mk.in b/config.mk.in
index 45269afab..cfef6b8d3 100644
--- a/config.mk.in
+++ b/config.mk.in
@@ -51,9 +51,14 @@ HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
 
 MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 
+# User variables - should not be modified in the code (as they are reserved for
+# the user building the package); see the following for details:
+# https://www.gnu.org/software/automake/manual/1.16.5/html_node/User-Variables.html
 CC=@CC@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
+
+# Project variables
 LIBS=@LIBS@
 
 ifdef NO_EXTRA_CFLAGS
diff --git a/src/prog.mk b/src/prog.mk
index 84f43142d..b2ccf6147 100644
--- a/src/prog.mk
+++ b/src/prog.mk
@@ -9,25 +9,26 @@ HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS)
 SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS)
 OBJS := $(SRCS:.c=.o) $(MOD_OBJS)
 
-CFLAGS += \
+PROG_CFLAGS = \
         -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \
         -fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \
         -fPIE \
         -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' \
         -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' \
         -DVARDIR='"/var/lib/firejail"' \
-        $(HAVE_GCOV) $(MANFLAGS)
+        $(HAVE_GCOV) $(MANFLAGS) \
+        $(EXTRA_CFLAGS)
 
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
+PROG_LDFLAGS = -pie -fPIE -Wl,-z,relro -Wl,-z,now $(EXTRA_LDFLAGS)
 
 .PHONY: all
 all: $(TARGET)
 
 %.o : %.c $(HDRS) $(ROOT)/config.mk
-        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(PROG_CFLAGS) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
 $(PROG): $(OBJS) $(ROOT)/config.mk
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+        $(CC) $(PROG_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
 
 .PHONY: clean
 clean:; rm -fr *.o $(PROG) *.gcov *.gcda *.gcno *.plist $(TOCLEAN)
diff --git a/src/so.mk b/src/so.mk
index 10c43ad21..28bd229e5 100644
--- a/src/so.mk
+++ b/src/so.mk
@@ -9,21 +9,21 @@ HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS)
 SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS)
 OBJS := $(SRCS:.c=.o) $(MOD_OBJS)
 
-CFLAGS += \
+SO_CFLAGS = \
         -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \
         -fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \
         -fPIC
 
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
+SO_LDFLAGS = -pie -fPIE -Wl,-z,relro -Wl,-z,now
 
 .PHONY: all
 all: $(TARGET)
 
 %.o : %.c $(HDRS) $(ROOT)/config.mk
-        $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
+        $(CC) $(SO_CFLAGS) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
 $(SO): $(OBJS) $(ROOT)/config.mk
-        $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl
+        $(CC) $(SO_LDFLAGS) -shared -fPIC -z relro $(LDFLAGS) -o $@ $(OBJS) -ldl
 
 .PHONY: clean
 clean:; rm -fr $(OBJS) $(SO) *.plist $(TOCLEAN)