Add -D_FORTIFY_SOURCE=2 for fixing hardening-check

[PokhodenkoSA]

See https://wiki.debian.org/HardeningWalkthrough#Testing_your_packages_after_conversion

[diptorupd]

Required security compiler’s flags:

-Wformat -Wformat-security -fstack-protector-all -D_FORTIFY_SOURCE=2 -fpic -fPIC -O3

Linker flags:

-Wl,-z,noexecstack,-z,relro,-z,now

Any recent GLIBC and stdlibc++ would work, I thought.

[diptorupd]

Can we reformat the flags like this to make them readable. Also do we not need -O3 ?

    set(CMAKE_C_FLAGS "                                                        \
        ${CMAKE_C_FLAGS}                                                       \
       -Wall                                                                   \
       -Wextra                                                                 \
       -Winit-self                                                             \
       -Wuninitialized                                                         \
       -Wmissing-declarations                                                  \
       -fdiagnostics-color=auto -O3                                            \
    ")
    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Qstd=c++17")
    set(CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} -ggdb3 -DDEBUG ")
elseif(UNIX)
    set(SDL_FLAGS "                                                            \
        -fstack-protector                                                      \
        -fstack-protector-all                                                  \
        -fpic                                                                  \
        -fPIC                                                                  \
        -D_FORTIFY_SOURCE=2                                                    \
        -Wformat                                                               \
        -Wformat-security                                                      \
        -fno-strict-overflow                                                   \
        -fno-delete-null-pointer-checks                                        \
        "
    )
    set(CMAKE_C_FLAGS "                                                        \
        ${CMAKE_C_FLAGS}                                                       \
        ${SDL_FLAGS}                                                           \
        -Wall                                                                  \
        -Wextra                                                                \
        -Winit-self                                                            \
        -Wuninitialized                                                        \
        -Wmissing-declarations                                                 \
        -fdiagnostics-color=auto                                               \
        -O3                                                                    \
        "
    )
    set(CMAKE_C_FLAGS_DEBUG "                                                  \
        ${CMAKE_C_FLAGS_DEBUG}                                                 \
         ${SDL_FLAGS}                                                          \
        -Wall                                                                  \
        -Wextra                                                                \
        -Winit-self                                                            \
        -Wuninitialized                                                        \
        -Wmissing-declarations                                                 \
        -fdiagnostics-color=auto                                               \
        -O0                                                                    \
        -ggdb3                                                                 \
        -DDEBUG                                                                \
        "
    )

[PokhodenkoSA]

This style of formatting makes a lot spaces in commands. You can see all calls to compilers if use make -j4 VERBOSE=1.

[PokhodenkoSA]

There will be a lot of spaces.

[PokhodenkoSA]

I would propose to use add_compile_options()

[diptorupd]

Ok, Then never mind.

[diptorupd]

-O3 needs to be added?

[PokhodenkoSA]

-O3 is part of CMAKE_CXX_FLAGS_RELEASE.

[diptorupd]

Of course.