You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <spanid="-Wl,-z,relro">`-Wl,-z,relro`</span><br/><spanid="-Wl,-z,now">`-Wl,-z,now`</span> | Binutils 2.15.0 | Mark relocation table entries resolved at load- time as read-only |
863
863
864
+
#### Synopsis
865
+
864
866
*“Read-only relocation”* (RELRO) marks relocation table entries as read-only after they have been resolved by the dynamic linker/loader (`ld.so`). Relocation is the process performed by `ld.so` that connects unresolved symbolic references to proper addresses of corresponding in-memory objects.
865
867
866
868
Marking relocations read-only will mitigate run-time attacks that corrupt Global Offset Table (GOT) entries to hijack program execution or to cause unintended data accesses. Collectively such attacks are referred to as *GOT overwrite attacks* or *GOT hijacking*.
@@ -1106,6 +1108,8 @@ The `-fexceptions` option is also needed for C code that needs to interoperate w
1106
1108
| <spanid="-fhardened">`-fhardened`</span> | GCC 14.0.0 | Enable pre-determined set of hardening options for C and C++ in GCC |
1107
1109
| <spanid="-Whardened">`-Whardened`</span> | GCC 14.0.0 | Warn if options implied by `-fhardened` are downgraded or disabled |
1108
1110
1111
+
#### Synopsis
1112
+
1109
1113
The `-fhardened` umbrella option enables a pre-determined set of hardening options for C and C++ on GNU/Linux targets[^gcc-fhardened]. The precise set of options may change between major releases of GCC. The exact set of options for a specific GCC version can be displayed using the `--help=hardened` option.
1110
1114
1111
1115
#### Additional Considerations
@@ -1132,6 +1136,8 @@ These warnings can be controlled explcitily via the `-Whardened` option.
1132
1136
|<span id="-Wl,--as-needed">`-Wl,--as-needed`</span>| Binutils 2.20.0 | Allow linker to omit libraries specified on the command line to link against if they are not used |
1133
1137
|<span id="-Wl,--no-copy-dt-needed-entries">`-Wl,--no-copy-dt-needed-entries`</span>| Binutils 2.20.0 | Stop linker from resolving symbols in produced binary to transitive dependencies |
1134
1138
1139
+
#### Synopsis
1140
+
1135
1141
The `--as-needed` option tells the GNU linker to only link the libraries containing symbols actually used by the produced binary. This contributes to minimizing the attack surface of the produced binary by precluding the execution of static initializers and deconstructors from unneeded libraries, and can also reduce the set of code available to code-reuse exploits, e.g., return-oriented programming.
1136
1142
1137
1143
The `--as-needed` option is enabled by default by many Linux distributions including Debian[^debian-dsolinking], Gentoo[^Berkholz08], Red Hat[^fedora-hardening], and SUSE Linux[^debian-dsolinking].
0 commit comments