Merge pull request #11825 from ifreund/std-build-relro

Enable full RELRO by default, expose in std.build

1 files changed, 14 insertions, 0 deletions

diff --git a/lib/std/build.zig b/lib/std/build.zig
index a738a39a1b..ce527ff021 100644
--- a/lib/std/build.zig
+++ b/lib/std/build.zig
@@ -1570,6 +1570,12 @@ pub const LibExeObjStep = struct {
     /// Permit read-only relocations in read-only segments. Disallowed by default.
     link_z_notext: bool = false,
 
+    /// Force all relocations to be read-only after processing.
+    link_z_relro: bool = true,
+
+    /// Allow relocations to be lazily processed after load.
+    link_z_lazy: bool = false,
+
     /// (Darwin) Install name for the dylib
     install_name: ?[]const u8 = null,
 
@@ -2577,6 +2583,14 @@ pub const LibExeObjStep = struct {
             try zig_args.append("-z");
             try zig_args.append("notext");
         }
+        if (!self.link_z_relro) {
+            try zig_args.append("-z");
+            try zig_args.append("norelro");
+        }
+        if (self.link_z_lazy) {
+            try zig_args.append("-z");
+            try zig_args.append("lazy");
+        }
 
         if (self.libc_file) |libc_file| {
             try zig_args.append("--libc");