Build the standalone binaries with -fPIE

2 files changed, 8 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index 8d7079e..211d2a7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,7 @@ remctl (3.13-1) UNRELEASED; urgency=medium
     - The summary configuration option is now allowed for commands with
       subcommands other than ALL, passing in two arguments to the summary
       command.
+  * Build the standalone binaries with -fPIE.
 
  -- Russ Allbery <rra@debian.org>  Mon, 10 Oct 2016 19:23:31 -0700
 
diff --git a/debian/rules b/debian/rules
index 3cda453..882e5ed 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,13 +1,18 @@
 #!/usr/bin/make -f
 
-# Add hardening build flags.  We have to omit PIE because it breaks the Perl
-# module build (and probably the other interpretors as well).
+# Add hardening build flags.  -fPIE is added separately below via hooks in
+# the upstream build system, since adding it globally breaks the language
+# binding modules.
 export DEB_BUILD_MAINT_OPTIONS = hardening=+bindnow
 
 # Link with --as-needed so that the remctl client library doesn't inherit
 # the shared library dependencies of libremctl.
 export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
 
+# Enable -fPIE for all binaries, picked up by the upstream build system.
+export REMCTL_PROGRAM_CFLAGS  = -fPIE
+export REMCTL_PROGRAM_LDFLAGS = -fPIE
+
 # The additional flags to pass to Build.PL, picked up by the upstream build
 # system.
 export REMCTL_PERL_FLAGS := --installdirs vendor --create_packlist 0