git: link the Git wrapper using ASLR/DEP

Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) are two powerful techniques to stave off exploits. Since both essentially come for free (performance-wise) it is wise to enable them. Together with Git for Windows' 5b24535 (fixup! mingw: Compile the Git wrapper, 2016-02-03) this concludes addressing the ticket git-for-windows/git#644. Signed-off-by: Johannes Schindelin <[email protected]>
git-for-windows · Feb 3, 2016 · b9857a9 · b9857a9
1 parent 89751d3
commit b9857a9
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/mingw-w64-git/PKGBUILD b/mingw-w64-git/PKGBUILD
@@ -121,7 +121,12 @@ build() {
 	windres -O coff ../$basename.rc -o $basename.res || break
    done
   ) &&
-  LDOPTS="-s -O2 -Wall compat/win32/git-wrapper.o git.res -lshlwapi" &&
+  LDOPTS="-Wl,--dynamicbase -Wl,--nxcompat -fstack-protector-strong" &&
+  case "${MINGW_PACKAGE_PREFIX}" in
+  *-x86_64) LDOPTS="$LDOPTS -Wl,--pic-executable,-e,mainCRTStartup";;
+  *-i686) LDOPTS="$LDOPTS -Wl,--pic-executable,-e,_mainCRTStartup";;
+  esac &&
+  LDOPTS="$LDOPTS -s -O2 -Wall compat/win32/git-wrapper.o git.res -lshlwapi" &&
   gcc -mwindows -o git-bash.exe git-bash.res $LDOPTS &&
   gcc -mconsole -o git-cmd.exe git-cmd.res $LDOPTS &&
   gcc -mconsole -o compat-bash.exe compat-bash.res $LDOPTS &&