rpm: Use hardened LDFLAGS

Currently, we do pass the hardened CFLAGS and CPPFLAGS when building the
code. However, we do not pass the hardened flags to the linker. This
means that the binaries are linked without the options like -Wl,-z,now.
As a result, we do not fully harden the binaries that we build.

This commit fixes this by passing the RPM_LD_FLAGS to the linker so the
builds are linked with the properly hardened flags.

Fixes: http://tracker.ceph.com/issues/36316
Signed-off-by: Boris Ranto <branto@redhat.com>
(cherry picked from commit ea6d7d2c9878b08528d120aa35e2fd9e18b3ba0f)

diff --git a/ceph.spec.in b/ceph.spec.in
index d708aea337a01658ed3b7467d7a5240ca16b9a21..fa34ade2dd11b1243df5d762b7c340ca3be90920 100644 (file)
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -806,6 +806,7 @@ export RPM_OPT_FLAGS=`echo $RPM_OPT_FLAGS | sed -e 's/i386/i486/'`
 export CPPFLAGS="$java_inc"
 export CFLAGS="$RPM_OPT_FLAGS"
 export CXXFLAGS="$RPM_OPT_FLAGS"
+export LDFLAGS="$RPM_LD_FLAGS"
 
 env | sort