Skip to content

Commit 95973ef

Browse files
committed
INSTALL.md: Don't try to enumerate all the hardening options
Just point people to https://best.openssf.org/Compiler-Hardening-Guides/ which is what sudo uses as a guide.
1 parent 1a66d1b commit 95973ef

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

INSTALL.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -222,10 +222,11 @@ Defaults are listed in brackets after the description.
222222

223223
--disable-hardening
224224
Disable the use of compiler/linker exploit mitigation options
225-
which are enabled by default. This includes compiling with
226-
_FORTIFY_SOURCE defined to 2, building with -fstack-protector,
227-
-fstack-clash-protection, -fcf-protection and linking with
228-
-zrelro, -znow, and -znoexecstack where supported.
225+
which are enabled by default. Sudo uses hardening options
226+
from https://best.openssf.org/Compiler-Hardening-Guides
227+
where supported. When building a sudo package on a system
228+
with its own hardening defaults, you may wish to disable
229+
sudo's options in favor of the native ones.
229230

230231
--disable-largefile
231232
Disable support for large (64-bit) files on 32-bit systems

0 commit comments

Comments
 (0)