From b26bb91ee9ab9e768226f6bda1489da186bbc4cb Mon Sep 17 00:00:00 2001 From: xq9mend Date: Thu, 2 Jul 2026 00:30:49 +0000 Subject: [PATCH 1/3] enable hardening=+all and FORTIFY_SOURCE=3 Add DEB_BUILD_MAINT_OPTIONS = hardening=+all to enable the full set of dpkg-buildflags hardening options (-fstack-protector-strong, RELRO, NX, etc.), and upgrade FORTIFY_SOURCE to level 3. dpkg sets FORTIFY_SOURCE=2 by default; the -U flag clears it before setting =3 to avoid duplicate-definition warnings. Signed-off-by: xq9mend --- debian/rules | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/debian/rules b/debian/rules index 60a99a3a..65005ae2 100755 --- a/debian/rules +++ b/debian/rules @@ -1,5 +1,9 @@ #!/usr/bin/make -f +export DEB_BUILD_MAINT_OPTIONS = hardening=+all +# Upgrade FORTIFY_SOURCE to level 3 (dpkg default is =2). +export DEB_CPPFLAGS_MAINT_APPEND = -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 + %: dh $@ --parallel From 770a7e9fa0710bf1bba1bc5424ec23d88017838c Mon Sep 17 00:00:00 2001 From: xq9mend <267839773+xq9mend@users.noreply.github.com> Date: Thu, 2 Jul 2026 15:08:15 -0700 Subject: [PATCH 2/3] debian/rules: add full OpenSSF compiler hardening baseline --- debian/rules | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/debian/rules b/debian/rules index 65005ae2..a00a4b3e 100755 --- a/debian/rules +++ b/debian/rules @@ -1,8 +1,21 @@ #!/usr/bin/make -f -export DEB_BUILD_MAINT_OPTIONS = hardening=+all -# Upgrade FORTIFY_SOURCE to level 3 (dpkg default is =2). -export DEB_CPPFLAGS_MAINT_APPEND = -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 +# Provides DEB_HOST_ARCH for arch-conditional compiler flags below. +include /usr/share/dpkg/architecture.mk + +# +bindnow enables -Wl,-z,now (full RELRO); required by OpenSSF hardening baseline. +export DEB_BUILD_MAINT_OPTIONS = hardening=+all,+bindnow +# OpenSSF Compiler Options Hardening Guide baseline. +# FORTIFY_SOURCE=3: upgraded from dpkg default of =2. +# _GLIBCXX_ASSERTIONS: C++ stdlib bounds checking. +export DEB_CPPFLAGS_MAINT_APPEND = -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS +# fstack-clash-protection: not in bookworm hardening area; inject directly. +# fcf-protection/mbranch-protection: arch-specific CFI. +# Production safety flags per OpenSSF baseline. +export DEB_CFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -ftrivial-auto-var-init=zero +export DEB_CXXFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -ftrivial-auto-var-init=zero +# Linker hardening: nodlopen, noexecstack, as-needed, no-copy-dt-needed-entries. +export DEB_LDFLAGS_MAINT_APPEND = -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,--as-needed -Wl,--no-copy-dt-needed-entries %: dh $@ --parallel From d5e3b3011389100db7929b8804fad9504e24607e Mon Sep 17 00:00:00 2001 From: xq9mend <267839773+xq9mend@users.noreply.github.com> Date: Thu, 2 Jul 2026 15:37:09 -0700 Subject: [PATCH 3/3] debian/rules: guard ftrivial-auto-var-init on GCC>=12, drop no-copy-dt-needed-entries --- debian/rules | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/debian/rules b/debian/rules index a00a4b3e..96f1bbd3 100755 --- a/debian/rules +++ b/debian/rules @@ -12,10 +12,14 @@ export DEB_CPPFLAGS_MAINT_APPEND = -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIB # fstack-clash-protection: not in bookworm hardening area; inject directly. # fcf-protection/mbranch-protection: arch-specific CFI. # Production safety flags per OpenSSF baseline. -export DEB_CFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -ftrivial-auto-var-init=zero -export DEB_CXXFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -ftrivial-auto-var-init=zero -# Linker hardening: nodlopen, noexecstack, as-needed, no-copy-dt-needed-entries. -export DEB_LDFLAGS_MAINT_APPEND = -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,--as-needed -Wl,--no-copy-dt-needed-entries +# -ftrivial-auto-var-init=zero requires GCC >= 12; omit on older toolchains. +GCC_MAJOR := $(shell gcc -dumpversion 2>/dev/null | cut -d. -f1) +TRIVIAL_INIT := $(shell [ "$(GCC_MAJOR)" -ge 12 ] 2>/dev/null && echo "-ftrivial-auto-var-init=zero" || echo "") +export DEB_CFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing $(TRIVIAL_INIT) +export DEB_CXXFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing $(TRIVIAL_INIT) +# Linker hardening: nodlopen, noexecstack, as-needed. +# --no-copy-dt-needed-entries omitted: requires explicit transitive dep fixes per-repo. +export DEB_LDFLAGS_MAINT_APPEND = -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,--as-needed %: dh $@ --parallel