From f1e7eca82ae5acb67481acf515da122a90899c00 Mon Sep 17 00:00:00 2001 From: Chengzhong Wu Date: Fri, 30 Oct 2026 12:17:34 -0400 Subject: [PATCH] build: enable pie on linux Signed-off-by: Chengzhong Wu --- common.gypi | 17 +++++++++++++++++ configure.py | 7 ++++++- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/common.gypi b/common.gypi index f8588b823119..c517d1c52f3d 100644 --- a/common.gypi +++ b/common.gypi @@ -699,6 +699,23 @@ 'cflags': [ '-fPIC' ], 'ldflags': [ '-fPIC' ], }], + # Link executables as PIE so that ASLR randomizes the executable + # image too. Every object in a PIE must be built with `-fPIC` or + # `-fPIE`. PIE flags should not apply to shared library objects, + # like addons. `--fully-static` uses `-static-pie`, see configure.py. + [ 'OS=="linux" and configuring_node', { + 'target_conditions': [ + ['_type=="executable"', { + 'ldflags': [ '-pie' ], + }], + ], + 'conditions': [ + # Use `-fPIE` unless the condition above uses `-fPIC`. + [ 'node_shared!="true" and node_enable_v8debughelper!="true"', { + 'cflags': [ '-fPIE' ], + }], + ], + }], ], }], [ 'OS in "aix os400"', { diff --git a/configure.py b/configure.py index d9d75443e7c6..82ce47b30a1a 100755 --- a/configure.py +++ b/configure.py @@ -2472,7 +2472,12 @@ def configure_static(o): return if options.fully_static: - o['libraries'] += ['-static'] + if flavor == 'linux': + # `-static` drops the `-pie` from common.gypi, e.g. clang: + # https://github.com/llvm/llvm-project/blob/68b03cf380e61c86aa59f94a10e8ce2d4c10cbb0/clang/lib/Driver/ToolChains/Gnu.cpp#L351-L366 + o['libraries'] += ['-static-pie'] + else: + o['libraries'] += ['-static'] elif options.partly_static: o['libraries'] += ['-static-libgcc', '-static-libstdc++'] if options.enable_asan: