Add hardening flags

[marcusmueller]

Fedora 28 introduced

https://fedoraproject.org/wiki/Changes/HardeningFlags28

• 1. Compile all binaries with stack clash protection (-fstack-clash-protection). As a result, attempts to jump the stack guard (a requirement for stack clash attacks) will reliably result in a crash rather than giving the attacker control over stack/heap objects.
• 2. Enable C++ standard library hardening with -D_GLIBCXX_ASSERTIONS. This turns on cheap range checks for C++ arrays, vectors, and strings.
• 3. Enable control flow protection on x86-64 using -fcf-protection=full -mcet.
• 4. Enable .got.plt isolation in binutils, to support a read-only GOT with lazy binding on systems which provide support for memory protection keys.
• 5. Use --enable-default-pie to ensure PIE support is enabled across all architectures.

I want that shit, too!

Not all of these flags exist on not-very-extremely-recent GCCs, but especially 2. is available everywhere and will jump into our face a lot.

[noc0lour]

We might consider pulling 1. & 5. into the main GNU Radio flags?

[noc0lour]

Is this:

 argv: [b'cmake', b'/data/src/pull/1806/maint-3.7', b'-DPYTHON_EXECUTABLE=/usr/bin/python2', b'-DDESIRED_QT_VERSION=4', b'-DCMAKE_CXX_COMPILER_FLAGS=-D_GLIBCXX_ASSERTIONS']```

correct in the case of GLIBCXX_ASSERTIONS?

[marcusmueller]

@noc0lour no, not really.

This overrides CMake's own CXX flags. I've searched up and down, and it seems CMake simply doesn't allow to specify additional flags on the command line.

We'll need to add a CMake directive that adds these flags.

[noc0lour]

Meh, I should use: CMAKE_CXX_FLAGS, that's what one wants.

[noc0lour]

https://cmake.org/cmake/help/latest/variable/CMAKE_LANG_FLAGS.html#variable:CMAKE_%3CLANG%3E_FLAGS

[noc0lour]

Which usually takes CXXFLAGS from the environment, but if you specify it on the cmdline it will take in the flags as well and append them to the internal cmake flags.

[noc0lour]

And currently the flags are not added.

[noc0lour]

@marcusmueller -DCMAKE_CXX_FLAGS=-D_GLIBCXX_ASSERTIONS works equally well and we don't need to touch unrelated GNU Radio cmake code .

[noc0lour]

or even setting the appropriate environment variable works as well.

[marcusmueller]

Ah, too mirror what @noc0lour and I have been talking off-site about this: yes, that works just as well. @noc0lour can we do that in the builders for maint-3.7 and master, then?

[noc0lour]

Done, so, to recap: cmake might exhibit strange behaviour if you use the flag on subsequent runs. But since the build directory is only used once for each build, we don't run into trouble here