NAME

       hardened-ld - linker wrapper to enforce hardening toolchain improvements

SYNOPSIS

       export DEB_BUILD_HARDENING=1

       ld ...

DESCRIPTION

       The  hardened-ld  wrapper is normally used by calling ld as usual with DEB_BUILD_HARDENING
       set to 1. It will configure the necessary toolchain hardening features.  By  default,  all
       features are enabled. If a given feature does not work correctly and needs to be disabled,
       the corresponding environment variables mentioned below can be set to 0.

ENVIRONMENT

       DEB_BUILD_HARDENING=1
              Enable hardening features.

       DEB_BUILD_HARDENING_DEBUG=1
              Print the full resulting gcc command line to STDERR before calling gcc.

       DEB_BUILD_HARDENING_RELRO=0
              Don't mark ELF sections read-only after start. See README.Debian for details.

       DEB_BUILD_HARDENING_BINDNOW=0
              Don't mark ELF loader  for  start-up  dynamic  resolution.  See  README.Debian  for
              details.

NOTES

       System-wide settings can be added to /etc/hardening-wrapper.conf, one per line.

       The  real  ld is renamed ld.real, and a diversion is registered with dpkg-divert(1).  Thus
       hardened-ld's  idea  of  the  default  ld  is  dictated  by  whatever  package   installed
       /usr/bin/ld.

SEE ALSO

       hardened-cc(1) ld(1)