diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-02-12 12:52:58 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-02-12 12:52:58 -0500 |
| commit | e70e3d514589ff8de293cb15876485d51a5dd6aa (patch) | |
| tree | c3d720e9d359a486917209fb706784ac9ef52bdb /contrib | |
| parent | 4373f102b5a126ee159267a96f1edef1e4a353be (diff) | |
| parent | d290a0c00e7323ca3b1922c6e8a27aedfdfc984b (diff) | |
| download | podman-e70e3d514589ff8de293cb15876485d51a5dd6aa.tar.gz podman-e70e3d514589ff8de293cb15876485d51a5dd6aa.tar.bz2 podman-e70e3d514589ff8de293cb15876485d51a5dd6aa.zip | |
Merge pull request #9321 from lsm5/v3.0
[backport v3.0] hardening flags for fedora rpmbuilds
Diffstat (limited to 'contrib')
| -rw-r--r-- | contrib/spec/podman.spec.in | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/contrib/spec/podman.spec.in b/contrib/spec/podman.spec.in index fce2afbeb..42ab5ece0 100644 --- a/contrib/spec/podman.spec.in +++ b/contrib/spec/podman.spec.in @@ -380,6 +380,29 @@ tar zxf %{SOURCE1} %build mkdir _build pushd _build + +# These flags should work for all rpm distros and arches +export CGO_CFLAGS="-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE" + +%if 0%{?fedora} || 0%{?rhel} +# This flag is only present on RH-family distros +export CGO_CFLAGS+=" -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1" +%endif + +%ifnarch %{ix86} +# Build fails on i686 with this flag +export CGO_CFLAGS+=" -D_FILE_OFFSET_BITS=64" +%endif + +%ifarch x86_64 +# Builds only on x86_64 with this flag +export CGO_CFLAGS+=" -m64 -mtune=generic" +%if 0%{?fedora} || 0%{?rhel} >= 8 +# Build fails on rhel7 and non-86_64 with this flag +export CGO_CFLAGS+=" -fcf-protection" +%endif +%endif + mkdir -p src/%{provider}.%{provider_tld}/%{project} ln -s ../../../../ src/%{import_path} popd |