add --enable-hardening-flags to enable compiler hardening flags

distros typically have their own set via C[XX]FLAGS, so make
this an optional argument

some notes on the options:

-Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=2
https://www.redhat.com/en/blog/enhance-application-security-fortifysource
(I see Fedora has recently bumped to to 3 since Jan 2024
https://fedoraproject.org/wiki/Changes/Add_FORTIFY_SOURCE%3D3_to_distribution_build_flags
but here use 2 for now instead)

-Wp,-D_GLIBCXX_ASSERTIONS
https://fedoraproject.org/wiki/Changes/HardeningFlags28

-fstack-protector-strong
(We already apply this by default)

-fstack-clash-protection
https://fedoraproject.org/wiki/Changes/HardeningFlags28

-fcf-protection
https://fedoraproject.org/wiki/Changes/HardeningFlags28
https://cgit.freedesktop.org/libreoffice/core/commit/?id=af55dc3891f7950d392175004b2090cb0e54828e

and record the compiler flags in debuginfo
-grecord-gcc-switches

Change-Id: Ib05387bad8324b188bd4ed0ee327d6a7cf83973b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163312
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Andras Timar <andras.timar@collabora.com>
(cherry picked from commit 33483058f6e27f39633114721f7329c90571101d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166289
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/distro-configs/CPLinux-LOKit.conf b/distro-configs/CPLinux-LOKit.conf
index f545bb4b8199..0d879e5c99ae 100644
--- a/distro-configs/CPLinux-LOKit.conf
+++ b/distro-configs/CPLinux-LOKit.conf
@@ -1,3 +1,4 @@
+--enable-hardening-flags
 --enable-mpl-subset
 --with-vendor=Collabora
 --disable-community-flavor