2

I have a Qt project that I'm compiling with GCC and MinGW for Ubuntu and Windows.

I got a requirement to harden it by adding the following LDFLAGS:

  • Stack execution protection: LDFLAGS="-z noexecstack"
  • Data relocation and protection (RELRO): LDLFAGS="-z relro -z now"

The question is can this be done with .pro file and how? I found it easy to add LFLAGS and CFLAGS in the project file but couldn't find anything for LDFLAGS. Even the output Makefiles don't seem to have any LDFLAGS defined.

One way I found after long googling was to add QMAKE_CFLAGS_RELEASE += "--noexecstack" in the .pro file but I'm not convinced this is the right way.

After the line above, the generated Makefile looks like this:

CC            = gcc
CXX           = g++
DEFINES       = -DUNICODE -DMY_LIBRARY -DQT_NO_DEBUG -DQT_NETWORK_LIB -DQT_CORE_LIB
CFLAGS        = -pipe -fno-keep-inline-dllexport -O2 -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security --noexecstack -Wall -Wextra $(DEFINES)
CXXFLAGS      = -pipe -fno-keep-inline-dllexport -O2 -frtti -Wall -Wextra -fexceptions -mthreads $(DEFINES)
LINKER        = g++
LFLAGS        = -Wl,-s -shared -Wl,-subsystem,windows -mthreads -Wl,--out-implib,C:\libmylib0.a

noexecstack appears in the CLFAGS list but not sure if that's alright. CFLAGS is not the same as LDFLAGS. It doesn't seems to validate the command either since --thisdoesntexist seemed to go through as well when I tried.

Thank you in advance.

EDIT:

Based on Gwen's answer I tried adding QMAKE_LFLAGS += "-z noexecstack -z relro -z now" but this produced an error from ld.exe: error: unrecognized option '-z'

EDIT2:

Tool versions:

C:\Qt\Qt5.5.0\Tools\mingw492_32\bin>ld.exe -v
GNU ld (GNU Binutils) 2.24

C:\Qt\Qt5.5.0\Tools\mingw492_32\bin>g++.exe --version
g++.exe (i686-posix-dwarf-rev1, Built by MinGW-W64 project) 4.9.2
quinz
  • 1,282
  • 4
  • 21
  • 33

1 Answers1

1

With my configuration (QtCreator + Visual C++ compiler), the LFLAGS defined in the makefile is given to the linker, contrary to what is stated in the GNU make documentation:

LDFLAGS : Extra flags to give to compilers when they are supposed to invoke the linker[...] LFLAGS : Extra flags to give to Lex.

I think you should try adding QMAKE_LFLAGS += "-z noexecstack -z relro -z now" to your .pro file, empty your build folder, re-run qmake, and see if the option is given to the linker.

Gwen
  • 1,436
  • 3
  • 23
  • 31
  • Thanks for the reply @Gwen. ld fails with the line you mentioned. error: unrecognized option '-z'. I checked ld.exe --help and it doesn't include z flag and nothing related to noexecstack, relro or now what so ever. – quinz Mar 22 '16 at 14:24
  • The [ld documentation](https://sourceware.org/binutils/docs/ld/Options.html) mentions this option for v 2.26. What is your gcc version ? Edit: I don't have it in ld 2.25. – Gwen Mar 22 '16 at 15:34
  • Thanks mate, it seems that my ld is version 2.24. Let me try updating it and see if that works. Also updated the question with version info. – quinz Mar 23 '16 at 11:46