summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--cmake/QtFeature.cmake11
-rw-r--r--cmake/QtInternalTargets.cmake46
-rw-r--r--config_help.txt11
-rw-r--r--configure.cmake163
-rw-r--r--qt_cmdline.cmake7
5 files changed, 203 insertions, 35 deletions
diff --git a/cmake/QtFeature.cmake b/cmake/QtFeature.cmake
index afe0417f61..96cb308b2c 100644
--- a/cmake/QtFeature.cmake
+++ b/cmake/QtFeature.cmake
@@ -1359,7 +1359,16 @@ function(qt_config_linker_supports_flag_test name)
endif()
cmake_parse_arguments(arg "" "LABEL;FLAG" "" ${ARGN})
- set(flags "-Wl,${arg_FLAG}")
+ if(GCC OR CLANG)
+ set(flags "-Wl,--fatal-warnings,${arg_FLAG}")
+ elseif(MSVC)
+ set(flags "${arg_FLAG}")
+ else()
+ # We don't know how to pass linker options in a way that
+ # it reliably fails, so assume the detection failed.
+ set(TEST_${name} "0" CACHE INTERNAL "${label}")
+ return()
+ endif()
# Pass the linker that the main project uses to the compile test.
qt_internal_get_active_linker_flags(linker_flags)
diff --git a/cmake/QtInternalTargets.cmake b/cmake/QtInternalTargets.cmake
index bdba1b5be1..885665b7ed 100644
--- a/cmake/QtInternalTargets.cmake
+++ b/cmake/QtInternalTargets.cmake
@@ -316,18 +316,52 @@ if (GCC AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL "9.2")
target_compile_options(PlatformCommonInternal INTERFACE $<$<COMPILE_LANGUAGE:CXX>:-Wsuggest-override>)
endif()
+# Hardening options
if(QT_FEATURE_intelcet)
if(MSVC)
- qt_internal_platform_link_options(PlatformCommonInternal INTERFACE
- -CETCOMPAT
- )
+ qt_internal_platform_link_options(PlatformCommonInternal INTERFACE -CETCOMPAT)
else()
- target_compile_options(PlatformCommonInternal INTERFACE
- -fcf-protection=full
- )
+ target_compile_options(PlatformCommonInternal INTERFACE -fcf-protection=full)
+ endif()
+endif()
+
+if(QT_FEATURE_glibc_fortify_source)
+ set(is_optimized_build "$<OR:$<NOT:$<CONFIG:Debug>>,$<BOOL:${QT_FEATURE_optimize_debug}>>")
+ # Some compilers may define _FORTIFY_SOURCE by default when optimizing, remove it
+ # before defining our own
+ target_compile_options(PlatformCommonInternal BEFORE INTERFACE "$<${is_optimized_build}:-U_FORTIFY_SOURCE>")
+ if(TEST_glibc_234)
+ target_compile_options(PlatformCommonInternal INTERFACE "$<${is_optimized_build}:-D_FORTIFY_SOURCE=3>")
+ else()
+ target_compile_options(PlatformCommonInternal INTERFACE "$<${is_optimized_build}:-D_FORTIFY_SOURCE=2>")
endif()
endif()
+if(QT_FEATURE_trivial_auto_var_init_pattern)
+ target_compile_options(PlatformCommonInternal INTERFACE -ftrivial-auto-var-init=pattern)
+endif()
+
+if(QT_FEATURE_stack_protector)
+ target_compile_options(PlatformCommonInternal INTERFACE -fstack-protector-strong)
+endif()
+
+if(QT_FEATURE_stack_clash_protection)
+ target_compile_options(PlatformCommonInternal INTERFACE -fstack-clash-protection)
+endif()
+
+if(QT_FEATURE_libstdcpp_assertions)
+ target_compile_definitions(PlatformCommonInternal INTERFACE _GLIBCXX_ASSERTIONS)
+endif()
+
+if(QT_FEATURE_libcpp_hardening)
+ target_compile_definitions(PlatformCommonInternal INTERFACE -D_LIBCPP_HARDENING_MODE="$<IF:$<CONFIG:Debug>,_LIBCPP_HARDENING_MODE_EXTENSIVE,_LIBCPP_HARDENING_MODE_FAST>")
+endif()
+
+if(QT_FEATURE_relro_now_linker)
+ qt_internal_platform_link_options(PlatformCommonInternal INTERFACE "-Wl,-z,relro,-z,now")
+endif()
+
+
if(QT_FEATURE_force_asserts)
target_compile_definitions(PlatformCommonInternal INTERFACE QT_FORCE_ASSERTS)
endif()
diff --git a/config_help.txt b/config_help.txt
index c6273a53f7..a5f8cd62df 100644
--- a/config_help.txt
+++ b/config_help.txt
@@ -138,7 +138,16 @@ Build options:
-pch ................. Use precompiled headers [auto]
-ltcg ................ Use Link Time Code Generation [no]
- -intelcet ............ Use Intel Control-flow Enforcement Technology [no]
+ -intelcet ............ Use Intel Control-flow Enforcement Technology [auto]
+ -glibc-fortify-source Use Glibc function fortification [auto]
+ -trivial-auto-var-init-pattern
+ Use -ftrivial-auto-var-init=pattern [auto]
+ -stack-protector ..... Use -fstack-protector-strong [auto]
+ -stack-clash-protection
+ Use -fstack-clash-protection [auto]
+ -libstdcpp-assertions Use libstdc++ assertions [auto]
+ -libcpp-hardening .... Use libc++ hardening [auto]
+ -relro-now-linker .... Use -z relro -z now when linking [auto]
-linker [bfd,gold,lld,mold]
Force use of the GNU ld, GNU gold, LLVM/LLD or mold
linker instead of default one (GCC and clang only)
diff --git a/configure.cmake b/configure.cmake
index 74ea2133f0..caa1366ea2 100644
--- a/configure.cmake
+++ b/configure.cmake
@@ -211,6 +211,28 @@ endif()
# machineTuple
qt_config_compile_test_machine_tuple("machine tuple")
+# glibc
+qt_config_compile_test(glibc
+ LABEL "Using Glibc"
+ CODE
+"#include <features.h>
+#ifndef __GLIBC__
+#error
+#endif
+int main() {}"
+)
+
+# glibc 2.34, for _FORTIFY_SOURCE == 3
+qt_config_compile_test(glibc_234
+ LABEL "Using Glibc >= 2.34"
+ CODE
+"#include <features.h>
+#if !defined(__GLIBC__) || !__GLIBC_PREREQ(2, 34)
+#error
+#endif
+int main() {}"
+)
+
# cxx20
qt_config_compile_test(cxx20
LABEL "C++20 support"
@@ -398,29 +420,40 @@ alloca(1);
")
# stack_protector
-qt_config_compile_test(stack_protector
- LABEL "stack protection"
- COMPILE_OPTIONS -fstack-protector-strong
- CODE
-"#ifdef __QNXNTO__
-# include <sys/neutrino.h>
-# if _NTO_VERSION < 700
-# error stack-protector not used (by default) before QNX 7.0.0.
-# endif
-#endif
+if(NOT WASM)
+ # emcc doesn't support this, but the detection accidentally succeeds
+ # https://github.com/emscripten-core/emscripten/issues/17030
+ qt_config_compiler_supports_flag_test(stack_protector
+ LABEL "stack protection"
+ FLAG "-fstack-protector-strong"
+ )
+endif()
-int main(void)
-{
- /* BEGIN TEST: */
- /* END TEST: */
- return 0;
-}
-")
+# stack_clash_protection
+if(NOT CLANG) # https://gitlab.kitware.com/cmake/cmake/-/issues/21998
+ qt_config_compiler_supports_flag_test(stack_clash_protection
+ LABEL "-fstack-clash-protection support"
+ FLAG "-fstack-clash-protection"
+ )
+endif()
+
+# trivial_auto_var_init_pattern
+qt_config_compiler_supports_flag_test(trivial_auto_var_init_pattern
+ LABEL "-ftrivial-auto-var-init=pattern support"
+ FLAG "-ftrivial-auto-var-init=pattern"
+)
# intelcet
-qt_config_compile_test(intelcet
- LABEL "Support for Intel Control-flow Enforcement Technology (CET)"
- CODE
+if(MSVC)
+ qt_config_linker_supports_flag_test(intelcet
+ LABEL "Support for Intel Control-flow Enforcement Technology (CET)"
+ FLAG "-CETCOMPAT"
+ )
+else()
+ qt_config_compile_test(intelcet
+ LABEL "Support for Intel Control-flow Enforcement Technology (CET)"
+ COMPILE_OPTIONS -fcf-protection=full
+ CODE
"int main(void)
{
/* BEGIN TEST: */
@@ -430,8 +463,35 @@ qt_config_compile_test(intelcet
/* END TEST: */
return 0;
}
-")
+"
+ )
+endif()
+# -z relro -z now
+if(NOT WIN32)
+ qt_config_linker_supports_flag_test(relro_now_linker
+ LABEL "Support for -z relro and -z now"
+ FLAG "-z,relro,-z,now"
+ )
+endif()
+
+# Is libc++ the default Standard Library?
+qt_config_compile_test(using_stdlib_libcpp
+ LABEL "Compiler defaults to libc++"
+ CODE
+"
+#include <ciso646>
+
+int main(void)
+{
+/* BEGIN TEST: */
+#ifndef _LIBCPP_VERSION
+# error
+#endif
+/* END TEST: */
+}
+"
+)
#### Features
@@ -889,10 +949,6 @@ qt_feature("alloca" PRIVATE
LABEL "alloca()"
CONDITION QT_FEATURE_alloca_h OR QT_FEATURE_alloca_malloc_h OR TEST_alloca_stdlib_h
)
-qt_feature("stack-protector-strong" PRIVATE
- LABEL "stack protection"
- CONDITION QNX AND TEST_stack_protector
-)
qt_feature("system-zlib" PRIVATE
LABEL "Using system zlib"
CONDITION WrapSystemZLIB_FOUND
@@ -1056,10 +1112,56 @@ qt_feature("relocatable" PRIVATE
AUTODETECT QT_FEATURE_shared
CONDITION QT_FEATURE_dlopen OR WIN32 OR NOT QT_FEATURE_shared
)
+# hardening features
qt_feature("intelcet" PRIVATE
- LABEL "Using Intel CET"
- CONDITION ( INPUT_intelcet STREQUAL yes ) OR TEST_intelcet
+ LABEL "Using Intel Control-flow Enforcement Technology (CET)"
+ AUTODETECT ON
+ CONDITION TEST_intelcet
)
+qt_feature_config("intelcet" QMAKE_PUBLIC_CONFIG)
+qt_feature("glibc_fortify_source" PRIVATE
+ LABEL "Using Glibc function fortification"
+ AUTODETECT ON
+ CONDITION TEST_glibc
+)
+qt_feature_config("glibc_fortify_source" QMAKE_PUBLIC_CONFIG)
+qt_feature("trivial_auto_var_init_pattern" PRIVATE
+ LABEL "Using -ftrivial-auto-var-init=pattern"
+ AUTODETECT ON
+ CONDITION TEST_trivial_auto_var_init_pattern
+)
+qt_feature_config("trivial_auto_var_init_pattern" QMAKE_PUBLIC_CONFIG)
+qt_feature("stack_protector" PRIVATE
+ LABEL "Using -fstack-protector-strong"
+ AUTODETECT ON
+ CONDITION TEST_stack_protector
+)
+qt_feature_config("stack_protector" QMAKE_PUBLIC_CONFIG)
+qt_feature("stack_clash_protection" PRIVATE
+ LABEL "Using -fstack-clash-protection"
+ AUTODETECT ON
+ CONDITION TEST_stack_clash_protection
+)
+qt_feature_config("stack_clash_protection" QMAKE_PUBLIC_CONFIG)
+qt_feature("libstdcpp_assertions" PRIVATE
+ LABEL "Using libstdc++ assertions"
+ AUTODETECT ON
+ CONDITION (GCC OR (CLANG AND NOT MSVC AND NOT QT_FEATURE_stdlib_libcpp AND NOT TEST_using_stdlib_libcpp))
+)
+qt_feature_config("libstdcpp_assertions" QMAKE_PUBLIC_CONFIG)
+qt_feature("libcpp_hardening" PRIVATE
+ LABEL "Using libc++ hardening"
+ AUTODETECT ON
+ CONDITION (QT_FEATURE_stdlib_libcpp OR TEST_using_stdlib_libcpp)
+)
+qt_feature_config("libcpp_hardening" QMAKE_PUBLIC_CONFIG)
+qt_feature("relro_now_linker" PRIVATE
+ LABEL "Using -z relro -z now when linking"
+ AUTODETECT ON
+ CONDITION TEST_relro_now_linker
+)
+qt_feature_config("relro_now_linker" QMAKE_PUBLIC_CONFIG)
+
if("${INPUT_coverage}" STREQUAL "gcov")
qt_config_compile_test(gcov
@@ -1137,6 +1239,13 @@ qt_configure_add_summary_entry(ARGS "relocatable")
qt_configure_add_summary_entry(ARGS "precompile_header")
qt_configure_add_summary_entry(ARGS "ltcg")
qt_configure_add_summary_entry(ARGS "intelcet")
+qt_configure_add_summary_entry(ARGS "glibc_fortify_source")
+qt_configure_add_summary_entry(ARGS "trivial_auto_var_init_pattern")
+qt_configure_add_summary_entry(ARGS "stack_protector")
+qt_configure_add_summary_entry(ARGS "stack_clash_protection")
+qt_configure_add_summary_entry(ARGS "libstdcpp_assertions")
+qt_configure_add_summary_entry(ARGS "libcpp_hardening")
+qt_configure_add_summary_entry(ARGS "relro_now_linker")
qt_configure_add_summary_entry(
ARGS "wasm-simd128"
CONDITION ( TEST_architecture_arch STREQUAL wasm )
diff --git a/qt_cmdline.cmake b/qt_cmdline.cmake
index fdf22561e7..a01ad054c4 100644
--- a/qt_cmdline.cmake
+++ b/qt_cmdline.cmake
@@ -76,6 +76,13 @@ qt_commandline_option(openssl-runtime TYPE void NAME openssl VALUE runtime)
qt_commandline_option(linker TYPE optionalString VALUES bfd gold lld mold)
qt_commandline_option(ltcg TYPE boolean)
qt_commandline_option(intelcet TYPE boolean)
+qt_commandline_option(glibc_fortify_source TYPE boolean)
+qt_commandline_option(trivial_auto_var_init_pattern TYPE boolean)
+qt_commandline_option(stack_protector TYPE boolean)
+qt_commandline_option(stack_clash_protection TYPE boolean)
+qt_commandline_option(libstdcpp_assertions TYPE boolean)
+qt_commandline_option(libcpp_hardening TYPE boolean)
+qt_commandline_option(relro_now_linker TYPE boolean)
qt_commandline_option(make TYPE addString VALUES examples libs tests tools
benchmarks manual-tests minimal-static-tests)
qt_commandline_option(install-examples-sources TYPE boolean)