Skip to content

Add missing synopsis subheadings #920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 12, 2025
Merged

Add missing synopsis subheadings #920

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -861,6 +861,8 @@ In Linux prior to kernel version 5.8 a missing `PT_GNU_STACK` marking on x86_64
|:------------------------------------------------------------------------------------------- |:-------------:|:----------------------------------------------------------------- |
| <span id="-Wl,-z,relro">`-Wl,-z,relro`</span><br/><span id="-Wl,-z,now">`-Wl,-z,now`</span> | Binutils 2.15.0 | Mark relocation table entries resolved at load- time as read-only |

#### Synopsis

*“Read-only relocation”* (RELRO) marks relocation table entries as read-only after they have been resolved by the dynamic linker/loader (`ld.so`). Relocation is the process performed by `ld.so` that connects unresolved symbolic references to proper addresses of corresponding in-memory objects.

Marking relocations read-only will mitigate run-time attacks that corrupt Global Offset Table (GOT) entries to hijack program execution or to cause unintended data accesses. Collectively such attacks are referred to as *GOT overwrite attacks* or *GOT hijacking*.
Expand Down Expand Up @@ -1106,6 +1108,8 @@ The `-fexceptions` option is also needed for C code that needs to interoperate w
| <span id="-fhardened">`-fhardened`</span> | GCC 14.0.0 | Enable pre-determined set of hardening options for C and C++ in GCC |
| <span id="-Whardened">`-Whardened`</span> | GCC 14.0.0 | Warn if options implied by `-fhardened` are downgraded or disabled |

#### Synopsis

The `-fhardened` umbrella option enables a pre-determined set of hardening options for C and C++ on GNU/Linux targets[^gcc-fhardened]. The precise set of options may change between major releases of GCC. The exact set of options for a specific GCC version can be displayed using the `--help=hardened` option.

#### Additional Considerations
Expand All @@ -1132,6 +1136,8 @@ These warnings can be controlled explcitily via the `-Whardened` option.
| <span id="-Wl,--as-needed">`-Wl,--as-needed`</span> | Binutils 2.20.0 | Allow linker to omit libraries specified on the command line to link against if they are not used |
| <span id="-Wl,--no-copy-dt-needed-entries">`-Wl,--no-copy-dt-needed-entries`</span> | Binutils 2.20.0 | Stop linker from resolving symbols in produced binary to transitive dependencies |

#### Synopsis

The `--as-needed` option tells the GNU linker to only link the libraries containing symbols actually used by the produced binary. This contributes to minimizing the attack surface of the produced binary by precluding the execution of static initializers and deconstructors from unneeded libraries, and can also reduce the set of code available to code-reuse exploits, e.g., return-oriented programming.

The `--as-needed` option is enabled by default by many Linux distributions including Debian[^debian-dsolinking], Gentoo[^Berkholz08], Red Hat[^fedora-hardening], and SUSE Linux[^debian-dsolinking].
Expand Down