From 37b23e8d53ce4d1f96d21fb89b6f702cc8a8c788 Mon Sep 17 00:00:00 2001 From: netblue30 Date: Wed, 26 Jun 2019 10:24:28 -0400 Subject: testing for -fstack-clash-protection and -fstack-protector-strong compile flags --- configure | 94 +++++++++++++++++++++++++++++++++++++++++++++++++----------- configure.ac | 14 ++++++++- 2 files changed, 90 insertions(+), 18 deletions(-) diff --git a/configure b/configure index 60ec90adf..fda292896 100755 --- a/configure +++ b/configure @@ -682,7 +682,6 @@ infodir docdir oldincludedir includedir -runstatedir localstatedir sharedstatedir sysconfdir @@ -775,7 +774,6 @@ datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' -runstatedir='${localstatedir}/run' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' @@ -1028,15 +1026,6 @@ do | -silent | --silent | --silen | --sile | --sil) silent=yes ;; - -runstatedir | --runstatedir | --runstatedi | --runstated \ - | --runstate | --runstat | --runsta | --runst | --runs \ - | --run | --ru | --r) - ac_prev=runstatedir ;; - -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ - | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ - | --run=* | --ru=* | --r=*) - runstatedir=$ac_optarg ;; - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ @@ -1174,7 +1163,7 @@ fi for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ - libdir localedir mandir runstatedir + libdir localedir mandir do eval ac_val=\$$ac_var # Remove trailing slashes. @@ -1327,7 +1316,6 @@ Fine tuning of the installation directories: --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] - --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] @@ -3194,6 +3182,78 @@ else : fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-clash-protection" >&5 +$as_echo_n "checking whether C compiler accepts -fstack-clash-protection... " >&6; } +if ${ax_cv_check_cflags___fstack_clash_protection+:} false; then : + $as_echo_n "(cached) " >&6 +else + + ax_check_save_flags=$CFLAGS + CFLAGS="$CFLAGS -fstack-clash-protection" + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + ax_cv_check_cflags___fstack_clash_protection=yes +else + ax_cv_check_cflags___fstack_clash_protection=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + CFLAGS=$ax_check_save_flags +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_clash_protection" >&5 +$as_echo "$ax_cv_check_cflags___fstack_clash_protection" >&6; } +if test "x$ax_cv_check_cflags___fstack_clash_protection" = xyes; then : + HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-clash-protection" + +else + : +fi + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-protector-strong" >&5 +$as_echo_n "checking whether C compiler accepts -fstack-protector-strong... " >&6; } +if ${ax_cv_check_cflags___fstack_protector_strong+:} false; then : + $as_echo_n "(cached) " >&6 +else + + ax_check_save_flags=$CFLAGS + CFLAGS="$CFLAGS -fstack-protector-strong" + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + ax_cv_check_cflags___fstack_protector_strong=yes +else + ax_cv_check_cflags___fstack_protector_strong=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + CFLAGS=$ax_check_save_flags +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_protector_strong" >&5 +$as_echo "$ax_cv_check_cflags___fstack_protector_strong" >&6; } +if test "x$ax_cv_check_cflags___fstack_protector_strong" = xyes; then : + HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-protector-strong" + +else + : +fi + HAVE_APPARMOR="" # Check whether --enable-apparmor was given. @@ -3326,8 +3386,8 @@ if test "x$enable_apparmor" = "xyes"; then : HAVE_APPARMOR="-DHAVE_APPARMOR" pkg_failed=no -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for AA" >&5 -$as_echo_n "checking for AA... " >&6; } +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libapparmor" >&5 +$as_echo_n "checking for libapparmor... " >&6; } if test -n "$AA_CFLAGS"; then pkg_cv_AA_CFLAGS="$AA_CFLAGS" @@ -3367,7 +3427,7 @@ fi if test $pkg_failed = yes; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then @@ -3394,7 +3454,7 @@ Alternatively, you may set the environment variables AA_CFLAGS and AA_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details." "$LINENO" 5 elif test $pkg_failed = untried; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} diff --git a/configure.ac b/configure.ac index 675c8fd65..27dcb39c5 100644 --- a/configure.ac +++ b/configure.ac @@ -2,7 +2,11 @@ # Note: # # If for any reason autoconf fails, run "autoreconf -i --install " and try again. -# We rely soley on autoconf, without automake. Apparently, in this case +# This is how the error looks like on Arch Linux: +# ./configure: line 3064: syntax error near unexpected token `newline' +# ./configure: line 3064: `AX_CHECK_COMPILE_FLAG(' +# +# We rely solely on autoconf, without automake. Apparently, in this case # the macros from m4 directory are not picked up by default by automake. # "autoreconf -i --install" seems to fix the problem. # @@ -26,6 +30,14 @@ AX_CHECK_COMPILE_FLAG( [-mretpoline], [HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -mretpoline"] ) +AX_CHECK_COMPILE_FLAG( + [-fstack-clash-protection], + [HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-clash-protection"] +) +AX_CHECK_COMPILE_FLAG( + [-fstack-protector-strong], + [HAVE_SPECTRE="yes" && EXTRA_CFLAGS+=" -fstack-protector-strong"] +) HAVE_APPARMOR="" AC_ARG_ENABLE([apparmor], -- cgit v1.2.3-70-g09d2