From da4f8269bf5919f7a48739dbe5460fe22a768967 Mon Sep 17 00:00:00 2001
From: Sergei Golubchik <serg@mariadb.org>
Date: Mon, 16 Jun 2014 21:39:09 +0200
Subject: [PATCH] MDEV-5730 enhance security using special compilation options

-Wl,-z,relro,-z,now
-pie
-fstack-protector --param=ssp-buffer-size=4
-D_FORTIFY_SOURCE=2
---
 CMakeLists.txt | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index a5f2dc2a3ad..bc1193c441a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -199,6 +199,20 @@ IF (WITH_ASAN)
   ENDIF()
 ENDIF()
 
+OPTION(SECURITY_HARDENED "Use security-enhancing compiler features (stack protector, relro, etc)" ON)
+IF(SECURITY_HARDENED)
+  # security-enhancing flags
+  MY_CHECK_AND_SET_COMPILER_FLAG("-pie -fPIC")
+  MY_CHECK_AND_SET_COMPILER_FLAG("-Wl,-z,relro,-z,now")
+  MY_CHECK_AND_SET_COMPILER_FLAG("-fstack-protector --param=ssp-buffer-size=4")
+
+  # sometimes _FORTIFY_SOURCE is predefined
+  INCLUDE(CheckSymbolExists)
+  CHECK_SYMBOL_EXISTS(_FORTIFY_SOURCE "" HAVE_FORTIFY_SOURCE)
+  IF(NOT HAVE_FORTIFY_SOURCE)
+    ADD_DEFINITIONS(-D_FORTIFY_SOURCE=2)
+  ENDIF()
+ENDIF()
 
 OPTION(ENABLE_DEBUG_SYNC "Enable debug sync (debug builds only)" ON) 
 IF(ENABLE_DEBUG_SYNC)