security_compile

Link: https://code.alibaba-inc.com/oceanbase-ce-publish/oblogproxy/codereview/13664943 * security_compile * fix * security_compile
oceanbase · Aug 15, 2023 · 7c2d91b · 7c2d91b
1 parent 01a542b
commit 7c2d91b
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 2 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -92,7 +92,15 @@ else ()
 endif ()
 
 message(STATUS "COMPILER_DIR: ${COMPILER_DIR}")
+add_compile_options($<$<COMPILE_LANGUAGE:CXX,C>:-pipe>)
+add_compile_options($<$<COMPILE_LANGUAGE:CXX,C>:-fPIC>)
 
+add_compile_options($<$<COMPILE_LANGUAGE:CXX,C>:-pie>)
+add_compile_options($<$<COMPILE_LANGUAGE:CXX,C>:-znoexecstack>)
+add_compile_options($<$<COMPILE_LANGUAGE:CXX,C>:-znow>)
+add_compile_options($<$<COMPILE_LANGUAGE:CXX,C>:-fstack-protector-strong>)
+
+add_link_options($<$<COMPILE_LANGUAGE:CXX,C>:-Wl,-z,relro,-z,now>)
 find_program(CC NAMES gcc PATHS ${COMPILER_DIR} /usr/bin/ NO_DEFAULT_PATH)
 find_program(CXX NAMES g++ PATHS ${COMPILER_DIR} /usr/bin/ NO_DEFAULT_PATH)
 find_program(AR NAMES gcc-ar ar PATHS ${COMPILER_DIR} /usr/bin/ NO_DEFAULT_PATH)
@@ -421,6 +429,7 @@ target_include_directories(logproxy PUBLIC ${DEP_INC} ${LOGPROXY_INC})
 target_link_directories(logproxy PUBLIC ${DEP_LIB_PATH})
 target_link_libraries(logproxy ${BASE_LIBS} ${DEP_OBCDC_LIB} ${DEP_LIBS})
 target_link_options(logproxy PUBLIC -static-libstdc++ ${ASAN_LINK_OPTION})
+target_link_options(logproxy PRIVATE -pie)
 
 if (WITH_DEMO)
     # demo client

diff --git a/cmake/lz4.cmake b/cmake/lz4.cmake
@@ -4,6 +4,11 @@ SET(LZ4_SOURCES_DIR ${THIRD_PARTY_PATH}/lz4)
 SET(LZ4_INSTALL_DIR ${THIRD_PARTY_PATH}/install/lz4)
 SET(LZ4_INCLUDE_DIR "${LZ4_INSTALL_DIR}/lib" CACHE PATH "lz4 include directory." FORCE)
 SET(LZ4_LIBRARIES "${LZ4_INSTALL_DIR}/lib/liblz4.a" CACHE FILEPATH "lz4 library." FORCE)
+FILE(WRITE ${LZ4_SOURCES_DIR}/src/build.sh
+        "make clean;CFLAGS=-fPIC CXXFLAGS=-fPIC make VERBOSE=1 -j${NUM_OF_PROCESSOR} liblz4.a"
+        )
+
+
 
 INCLUDE_DIRECTORIES(${LZ4_INCLUDE_DIR})
 
@@ -13,14 +18,18 @@ ExternalProject_Add(
         extern_lz4
         ${EXTERNAL_PROJECT_LOG_ARGS}
         GIT_REPOSITORY "https://github.com/lz4/lz4.git"
-        GIT_TAG "v1.9.3"
+        GIT_TAG "v1.9.4"
         PREFIX ${LZ4_SOURCES_DIR}
         BUILD_IN_SOURCE ON
         UPDATE_COMMAND ""
         CONFIGURE_COMMAND ""
-        BUILD_COMMAND $(MAKE) -j${NUM_OF_PROCESSOR} liblz4.a
+        BUILD_COMMAND mv ../build.sh . COMMAND sh build.sh
         INSTALL_COMMAND mkdir -p ${LZ4_INSTALL_DIR} COMMAND cp -r ${LZ4_SOURCES_DIR}/src/extern_lz4/lib ${LZ4_INSTALL_DIR}/
         ${EXTERNAL_OPTIONAL_ARGS}
+        CMAKE_ARGS
+        -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON
+        -DCMAKE_BUILD_TYPE=${THIRD_PARTY_BUILD_TYPE}
 )
 
 ADD_LIBRARY(lz4 STATIC IMPORTED GLOBAL)