Add API for Binary Hardening

Open
#2,569 0 comments 0 reactions 1 assignee View on GitHub

@nickclark2016 is already working on this.

Since Dec 19, 2025.

Assessment

This issue has not been assessed yet.

Description

enhancement

What problem will this solve?
There have been efforts in recent years to harden STL implementations. GCC 14 added -fhardened to libstdc++ and MSVC 17.x's MS STL has the macro _MSVC_STL_HARDENING. Clang currently does not have a flag implemented, but there is an issue open (see https://github.com/llvm/llvm-project/issues/122687) and it can be reasonably emulated today.

What might be a solution?
Add a hardened API. Then we could allow specifying various "hardened" aspects. Sample usage:

hardened {
  "stl", -- Standard library hardening
  "aslr", -- Address space layout randomization (fpic, pie, dynamic base)
  "stack", -- Stack protection flags (-fstack-protector-strong, /GS)
  "controlflow", -- Control Flow protection (-fcf-protection=full, /cetcompat /guard:cf)
}

Another Option:

hardenstl "On/Off"
hardenaslr "On/Off"
hardenstack "On/Off"
controlflow "On/Off"

Open Questions: libc++ has various STL hardening modes (none, fast, extensive, debug). MS STL has an additional "destructor pointer tombstone" option. Would we support these, and if so, how would we want to do this? I think Option 2 allows for us to extend this better, especially if compilers start to turn these on by default.

What other alternatives have you already considered?
Flags can be manually added via the buildoptions API.

Anything else we should know?
Flag Suggestions: https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
libstdc++ Hardening: https://gcc.gnu.org/wiki/LibstdcxxDebugMode
libc++ Hardening: https://libcxx.llvm.org/Hardening.html
MS STL Hardening: https://github.com/microsoft/STL/wiki/STL-Hardening

Dominant language
C
Stars
3.6k
Forks
654
Avg merge
1d 1h
Merged PRs (30d)
13

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from premake/premake-core

All issues in premake/premake-core

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.