build: Enable BIND_NOW

Partial RELRO means that the object is GNU_RELRO but not BIND_NOW.  This
reduces the effectiveness of RELRO.  bluez triggers this because it
enables PIE during the build, and rpmdiff takes this as an indicator
that the best possible hardening is desired.

https://bugzilla.redhat.com/show_bug.cgi?id=983161
This commit is contained in:
Florian Weimer 2019-05-09 14:37:41 +02:00 committed by Luiz Augusto von Dentz
parent 3597960595
commit b406f28746

View File

@ -50,7 +50,7 @@ AC_DEFUN([MISC_FLAGS], [
if (test "${enableval}" = "yes" &&
test "${ac_cv_prog_cc_pie}" = "yes"); then
misc_cflags="$misc_cflags -fPIC"
misc_ldflags="$misc_ldflags -pie"
misc_ldflags="$misc_ldflags -pie -Wl,-z,now"
fi
])
if (test "$enable_coverage" = "yes"); then