Hardened build flags

[krille-chan]

Description

According to flutter/flutter#4368, it should be possible to pass some compiler flags to Flutter's build system. This means that it should be possible to get a PIE binary with hardening measures such as RELRO, no RUNPATH, and stack canaries.

Proposed changes: add -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -fstack-clash-protection -fcf-protection=full -fPIC -fPIE -fvisibility=hidden to the compiler flags, and add -pie to the LDFLAGS.

To Reproduce

Use checksec.sh on the Fluffychat binary to get the following output:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   RUNPATH     No Symbols         No    0               0               fluffychat/fluffychat

Additional information:

• Device: HP Elitebook 840 G1
• OS and OS version: Fedora 35, kernel 5.15.6
• Installed version of FluffyChat: 1.1.0 (Flatpak)

[github-actions]

This issue is stale because it has been open for 120 days with no activity.

[github-actions]

This issue was closed because it has been inactive for 14 days since being marked as stale.