hardened-ld (1)

---

NAME

hardened-ld - linker wrapper to enforce hardening toolchain improvements

SYNOPSIS

export DEB_BUILD_HARDENING=1

ld ...

DESCRIPTION

The hardened-ld wrapper is normally used by calling ld as usual with DEB_BUILD_HARDENING set to 1. It will configure the necessary toolchain hardening features. By default, all features are enabled. If a given feature does not work correctly and needs to be disabled, the corresponding environment variables mentioned below can be set to 0.

ENVIRONMENT

DEB_BUILD_HARDENING=1

Enable hardening features.

DEB_BUILD_HARDENING_DEBUG=1

Print the full resulting gcc command line to STDERR before calling gcc.

DEB_BUILD_HARDENING_RELRO=0

Don't mark ELF sections read-only after start. See README.Debian for details.

DEB_BUILD_HARDENING_BINDNOW=0

Don't mark ELF loader for start-up dynamic resolution. See README.Debian for details.

NOTES

System-wide settings can be added to /etc/hardening-wrapper.conf, one per line.

The real ld is renamed ld.real, and a diversion is registered with dpkg-divert(1). Thus hardened-ld's idea of the default ld is dictated by whatever package installed /usr/bin/ld.

SEE ALSO

hardened-cc(1) ld(1)

---