Enable -pie and -z,relro,-z,now for NativeAOT binaries

Fixes binskim warning BA3001 and BA3011 Contributes to #1738
jkotas · Nov 20, 2021 · 88a08e1 · 88a08e1
1 parent 7dcd615
commit 88a08e1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.props b/src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.props
@@ -78,6 +78,7 @@ The .NET Foundation licenses this file to you under the MIT license.
       <LinkerArg Include="-Wl,-rpath,'$ORIGIN'" Condition="'$(TargetOS)' != 'OSX'" />
       <LinkerArg Include="-Wl,-rpath,'@executable_path'" Condition="'$(TargetOS)' == 'OSX'" />
       <LinkerArg Include="-Wl,--as-needed" Condition="'$(TargetOS)' != 'OSX'" />
+      <LinkerArg Include="-Wl,-z,relro,-z,now" Condition="'$(TargetOS)' != 'OSX'" />
       <LinkerArg Include="-pthread" Condition="'$(TargetOS)' != 'OSX'" />
       <LinkerArg Include="-lstdc++" />
       <LinkerArg Include="-ldl" />
@@ -89,6 +90,7 @@ The .NET Foundation licenses this file to you under the MIT license.
       <LinkerArg Include="-licucore" Condition="'$(TargetOS)' == 'OSX'" />
       <LinkerArg Include="-dynamiclib" Condition="'$(TargetOS)' == 'OSX' and '$(NativeLib)' == 'Shared'" />
       <LinkerArg Include="-shared" Condition="'$(TargetOS)' != 'OSX' and '$(NativeLib)' == 'Shared'" />
+      <LinkerArg Include="-pie" Condition="'$(TargetOS)' != 'OSX' and '$(NativeLib)' == ''" />
       <LinkerArg Include="-Wl,-u,_CoreRT_StaticInitialization" Condition="'$(TargetOS)' == 'OSX' and '$(NativeLib)' == 'Shared'" />
       <LinkerArg Include="-Wl,--require-defined,CoreRT_StaticInitialization" Condition="'$(TargetOS)' != 'OSX' and '$(NativeLib)' == 'Shared'" />