Re: [PATCH 06/30] meson: tweak hardening options for Windows

[Marc-André Lureau]

Hi

On Fri, Dec 9, 2022 at 3:36 PM Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> -Wl,--dynamicbase has been enabled for DLLs upstream for roughly 2
> years (https://sourceware.org/bugzilla/show_bug.cgi?id=19011), and
> also by some distros including Debian for 6 years even
> (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836365), so
> just enable it unconditionally.
>
> Also add -Wl,--high-entropy-va.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  meson.build | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/meson.build b/meson.build
> index 5c6b5a1c757f..d61c7a82f112 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -193,10 +193,7 @@ qemu_ldflags += 
> cc.get_supported_link_arguments('-Wl,-z,relro', '-Wl,-z,now')
>
>  if targetos == 'windows'
>    qemu_ldflags += cc.get_supported_link_arguments('-Wl,--no-seh', 
> '-Wl,--nxcompat')
> -  # Disable ASLR for debug builds to allow debugging with gdb
> -  if get_option('optimization') == '0'
> -    qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase')
> -  endif
> +  qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase', 
> '-Wl,--high-entropy-va')

What about the comment for disabling ASLR on debug builds?

I wonder if we really have to add those flags ourself. Imho, we can
leave them to the compiler default or distrib.. I bet most of the deps
don't use those flags explicitly either.

-- 
Marc-André Lureau