build: wasm: Add an option for using strong stack protector
@@ -54,6 +54,15 @@ if (MSVC)
add_compile_options(/MT)
else()
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall")
+ # The following flags are to enhance security, but it may impact performance,
+ # we disable them by default.
+ if (FLB_WASM_STACK_PROTECT)
+ if (WAMR_BUILD_TARGET MATCHES "X86_.*" OR WAMR_BUILD_TARGET STREQUAL "AMD_64")
+ set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -ftrapv -D_FORTIFY_SOURCE=2")
+ endif ()
+ set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fstack-protector-strong --param ssp-buffer-size=4")
+ set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wl,-z,noexecstack,-z,relro,-z,now")
+ endif()
endif()
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D__FLB_FILENAME__=__FILE__")
@@ -131,6 +140,7 @@ option(FLB_ARROW "Build with Apache Arrow support" No)
option(FLB_WINDOWS_DEFAULTS "Build with predefined Windows settings" Yes)
option(FLB_WASM "Build with WASM runtime support" Yes)
option(FLB_WAMRC "Build with WASM AOT compiler executable" No)
+option(FLB_WASM_STACK_PROTECT "Build with WASM runtime with strong stack protector flags" No)
# Native Metrics Support (cmetrics)
option(FLB_METRICS "Enable metrics support" Yes)
