1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
.TH BUILDER-CC 1 "2002-03-02" "Debian Project" "Debian GNU/Linux"
.SH NAME
hardened-ld \- linker wrapper to enforce hardening toolchain improvements
.SH SYNOPSIS
.BI "export DEB_BUILD_HARDENING=1"
.br
.B ld
.I ...
.SH "DESCRIPTION"
The
.B hardened-ld
wrapper is normally used by calling
.B ld
as usual with
.B DEB_BUILD_HARDENING
set to 1. It will configure the necessary toolchain hardening
features. By default, all features are enabled. If a given feature does not
work correctly and needs to be disabled, the corresponding environment
variables mentioned below can be set to 0.
.SH ENVIRONMENT
.IP DEB_BUILD_HARDENING=1
Enable hardening features.
.IP DEB_BUILD_HARDENING_DEBUG=1
Print the full resulting gcc command line to STDERR before calling gcc.
.IP DEB_BUILD_HARDENING_RELRO=0
Don't mark ELF sections read-only after start. See README.Debian for details.
.SH NOTES
System-wide settings can be added to
.IR /etc/hardening-wrapper.conf ,
one per line.
The real
.B ld
is renamed
.BR ld.real ,
and a diversion is
registered with
.BR dpkg-divert (1).
Thus
.BR hardened-ld 's
idea of the default
.B ld
is dictated by whatever package installed
.IR /usr/bin/ld .
.SH "SEE ALSO"
.BR ld (1)
|