Don't override the user's FLAGS

Fedora for instance sets -fstack-protector-strong
but we override that with -fstack-protector, which is less secure

Ideally we never touch CFLAGS, CXXFLAGS and the like but fixing
that is an exercise left for the reader.

diff --git a/configure.ac b/configure.ac
index 9028cfe7b73b790abb337c375db31cd4854f8428..2918d0afb9fbfb33ae1f34b083b52f8871a0a091 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -339,9 +339,9 @@ for a in $dynmodules; do
   moduledirs="$moduledirs ${a}backend"
 done
 
-CFLAGS="$CFLAGS $PIE_CFLAGS"
-CXXFLAGS="$CXXFLAGS $PIE_CFLAGS"
-LDFLAGS="$LDFLAGS $RELRO_LDFLAGS"
+CFLAGS="$PIE_CFLAGS $CFLAGS"
+CXXFLAGS="$PIE_CFLAGS $CXXFLAGS"
+LDFLAGS="$RELRO_LDFLAGS $LDFLAGS"
 
 AC_SUBST(LIBS)
 

diff --git a/m4/pdns_d_fortify_source.m4 b/m4/pdns_d_fortify_source.m4
index 7f90329a9977547674f934d352ed3fc6e704e172..605990c47a773939616bb5f86a4e82fd6a47b8f9 100644 (file)
--- a/m4/pdns_d_fortify_source.m4
+++ b/m4/pdns_d_fortify_source.m4
@@ -22,7 +22,7 @@ AC_DEFUN([AC_CC_D_FORTIFY_SOURCE],[
       OLD_CXXFLAGS="$CXXFLAGS"
       CXXFLAGS="-Wall -W -Werror $CXXFLAGS"
       gl_COMPILER_OPTION_IF([-D_FORTIFY_SOURCE=2], [
-        CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2"
-        CXXFLAGS="$OLD_CXXFLAGS -D_FORTIFY_SOURCE=2"
+        CFLAGS="-D_FORTIFY_SOURCE=2 $CFLAGS"
+        CXXFLAGS="-D_FORTIFY_SOURCE=2 $OLD_CXXFLAGS"
       ], [CXXFLAGS="$OLD_CXXFLAGS"], [AC_LANG_PROGRAM([[#include <stdio.h>]],[])])
 ]) 

diff --git a/m4/pdns_param_ssp_buffer_size.m4 b/m4/pdns_param_ssp_buffer_size.m4
index 1c7ce83e8ec53f719fbdd1112bf8578beb2ba388..05c1baef041928549ff0ab2bdf6c90d71f3e2048 100644 (file)
--- a/m4/pdns_param_ssp_buffer_size.m4
+++ b/m4/pdns_param_ssp_buffer_size.m4
@@ -20,7 +20,7 @@ dnl
 
 AC_DEFUN([AC_CC_PARAM_SSP_BUFFER_SIZE],[
       gl_COMPILER_OPTION_IF([--param ssp-buffer-size=$1], [
-        CFLAGS="$CFLAGS --param ssp-buffer-size=$1"
-        CXXFLAGS="$CXXFLAGS --param ssp-buffer-size=$1"
+        CFLAGS="--param ssp-buffer-size=$1 $CFLAGS"
+        CXXFLAGS="--param ssp-buffer-size=$1 $CXXFLAGS"
       ])
 ]) 

diff --git a/m4/pdns_stack_protector.m4 b/m4/pdns_stack_protector.m4
index c268d48c586f06edde7218dfe94e526ff398527c..388035cf1cf9146dd8f45ab465f1ca240caf380c 100644 (file)
--- a/m4/pdns_stack_protector.m4
+++ b/m4/pdns_stack_protector.m4
@@ -20,7 +20,7 @@ dnl
 
 AC_DEFUN([AC_CC_STACK_PROTECTOR],[
       gl_COMPILER_OPTION_IF([-fstack-protector], [
-        CFLAGS="$CFLAGS -fstack-protector"
-        CXXFLAGS="$CXXFLAGS -fstack-protector"
+        CFLAGS="-fstack-protector $CFLAGS"
+        CXXFLAGS="-fstack-protector $CXXFLAGS"
       ])
 ])