From 49975380c5a6ffeceffe0e002a9a63171145053e Mon Sep 17 00:00:00 2001
From: zhangsong <zhangsong34@huawei.com>
Date: Fri, 29 Jan 2021 11:31:06 +0800
Subject: [PATCH] syscontainer-tools: build security option

Signed-off-by: zhangsong <zhangsong34@huawei.com>
---
 Makefile | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 4b3af7d..b7c45b2 100644
--- a/Makefile
+++ b/Makefile
@@ -20,8 +20,13 @@ VERSION := $(shell cat ./VERSION)
 BEP_DIR=/tmp/syscontainer-tools-build-bep
 BEP_FLAGS=-tmpdir=/tmp/syscontainer-tools-build-bep
 
-GO_LDFLAGS="-w -buildid=IdByiSula -extldflags -static $(BEP_FLAGS) -X main.gitCommit=${COMMIT} -X main.version=${VERSION}"
-ENV = GOPATH=${GOPATH} CGO_ENABLED=1
+GO_LDFLAGS="-buildid=IdByiSula $(BEP_FLAGS) -extldflags=-static -extldflags=-Wl,-z,relro,-z,now -X main.gitCommit=${COMMIT} -X main.version=${VERSION}"
+
+ENV = GOPATH=${GOPATH} \
+      CGO_ENABLED=1 \
+      CGO_CFLAGS="-fstack-protector-strong -fPIE" \
+      CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \
+      CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack"
 
 ## PLEASE be noticed that the vendor dir can only work with golang > 1.6 !!
 
@@ -34,12 +39,12 @@ init:
 
 syscontainer-tools: $(SOURCES) | $(DEPS_LINK)
 	@echo "Making syscontainer-tools..."
-	${ENV} go build -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-tools .
+	${ENV} go build -buildmode=pie -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-tools .
 	@echo "Done!"
 
 syscontainer-hooks: $(SOURCES) | $(DEPS_LINK)
 	@echo "Making syscontainer-hooks..."
-	${ENV} go build -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-hooks ./hooks/syscontainer-hooks
+	${ENV} go build -buildmode=pie -mod=vendor -tags ${TAGS} -ldflags ${GO_LDFLAGS} -o build/syscontainer-hooks ./hooks/syscontainer-hooks
 	@echo "Done!"
 
 localtest:
-- 
1.8.3.1