From 24b70368faeb709c2d802bc21692b26c4d38e146 Mon Sep 17 00:00:00 2001
From: zhangkun <zhangkun2@uniontech.com>
Date: Wed, 31 Dec 2025 17:36:56 +0800
Subject: [PATCH] fix: add noexecstack linker flag for security hardening
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The change adds the `-z,noexecstack` flag to the linker options
in the Debian build rules. This flag marks the stack as non-
executable, providing additional security hardening against stack-
based buffer overflow attacks. The flag is added conditionally for all
architectures except mips64el, maintaining the existing security flags
(-z,relro,-z,now,-pie) while enhancing protection.

Influence:
1. Verify the binary is built with the new linker flags by checking the
ELF program headers (e.g., using `readelf -l`)
2. Ensure the stack is marked as non-executable in the built executable
3. Test that the application functions correctly with the new security
hardening
4. Confirm the build process completes successfully for all supported
architectures except mips64el

fix: 为安全加固添加 noexecstack 链接器标志

此更改在 Debian 构建规则中向链接器选项添加了 `-z,noexecstack` 标志。该
标志将堆栈标记为不可执行，针对基于堆栈的缓冲区溢出攻击提供了额外的安全
加固。该标志有条件地添加到除 mips64el 外的所有架构，在保持现有安全标志
（-z,relro,-z,now,-pie）的同时增强了保护。

Influence:
1. 通过检查 ELF 程序头（例如使用 `readelf -l`）验证二进制文件是否使用新
的链接器标志构建
2. 确保构建的可执行文件中堆栈被标记为不可执行
3. 测试应用程序在新的安全加固下功能正常
4. 确认除 mips64el 外所有支持的架构的构建过程成功完成

PMS: BUG-339571
---
 debian/rules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index 82023ce..a8981a6 100755
--- a/debian/rules
+++ b/debian/rules
@@ -8,7 +8,7 @@ ifeq ($(DEB_BUILD_ARCH),sw_64)
 endif
 
 ifneq ($(DEB_BUILD_ARCH), mips64el)
-	export GOBUILD_OPTIONS=-ldflags '-linkmode=external -extldflags "-Wl,-z,relro,-z,now,-pie"'
+	export GOBUILD_OPTIONS=-ldflags '-linkmode=external -extldflags "-Wl,-z,relro,-z,now,-pie,-z,noexecstack"'
 endif
 
 %: