add security compile options

4 years ago · c722c5ac17
parent 95710ae970
commit c722c5ac17
2 changed files with 8 additions and 3 deletions
--- a/cmake/external_libs/tinyxml2.cmake
+++ b/cmake/external_libs/tinyxml2.cmake
@ -1,5 +1,10 @@
-set(tinyxml2_CXXFLAGS "-D_FORTIFY_SOURCE=2 -O2 -Wno-unused-result")
-set(tinyxml2_CFLAGS "-D_FORTIFY_SOURCE=2 -O2")
+set(tinyxml2_CXXFLAGS "-fstack-protector -D_FORTIFY_SOURCE=2 -O2 -Wno-unused-result")
+set(tinyxml2_CFLAGS "-fstack-protector -D_FORTIFY_SOURCE=2 -O2")
+
+if (NOT WIN32)
+    set(tinyxml2_LDFLAGS "-Wl,-z,relro,-z,now,-z,noexecstack")
+endif()
+
 mindspore_add_pkg(tinyxml2
        VER 8.0.0
        LIBS tinyxml2
--- a/scripts/build_icu4c.sh
+++ b/scripts/build_icu4c.sh
@ -5,4 +5,4 @@ echo '{
    "normalization": "include"
  }
 }' > filter.json
-./icu4c/source/runConfigureICU Linux --enable-rpath --disable-tests --disable-samples --disable-icuio --disable-extras ICU_DATA_FILTER_FILE=filter.json "$@"
+CFLAGS="-fstack-protector -Wl,-z,now -D_FORTIFY_SOURCE=2 -O2" ./icu4c/source/runConfigureICU Linux --enable-rpath --disable-tests --disable-samples --disable-icuio --disable-extras ICU_DATA_FILTER_FILE=filter.json "$@"