debian: use fortified libc.

dpkg-buildflags() emits a number of var=val pairs, which specifically
set LDFLAGS. By turning on hardening, the value includes -z,now to
tell the linker to resolve all symbols at startup time, which is a
prerequisite for a read-only global offset table.

Suggested-by: lintian(1)

diff --git a/debian/rules b/debian/rules
index 387b14c917d8e7563d8898696ba1294463bc95a9..ddb503d8fc4ef189bce5846383f4f0b686c6c2d5 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -24,7 +24,8 @@ TRIPLET := $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
 
 build-arch:
        $(checkdir)
-       $(MAKE)
+       $(MAKE) $(shell DEB_BUILD_MAINT_OPTIONS=hardening=+all \
+               dpkg-buildflags --export=cmdline)
 build-indep:
 build: build-indep build-arch