From 652c4e6ace7c4eae6ffb12093487c2d8180806f5 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Wed, 27 Nov 2013 13:13:16 +0000
Subject: [PATCH] Use hardening flags for ipa-optd.

https://fedorahosted.org/freeipa/ticket/4010
---
 daemons/ipa-otpd/Makefile.am | 2 +-
 freeipa.spec.in              | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/daemons/ipa-otpd/Makefile.am b/daemons/ipa-otpd/Makefile.am
index ed99c3ecb..f0b75284d 100644
--- a/daemons/ipa-otpd/Makefile.am
+++ b/daemons/ipa-otpd/Makefile.am
@@ -1,5 +1,5 @@
 AM_CFLAGS := $(CFLAGS) @LDAP_CFLAGS@ @LIBVERTO_CFLAGS@
-AM_LDFLAGS := $(LDFLAGS) @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@
+AM_LDFLAGS := $(LDFLAGS) @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@ -pie -Wl,-z,relro -Wl,-z,now
 
 noinst_HEADERS = internal.h
 libexec_PROGRAMS = ipa-otpd
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 35b87148c..8ee69fc77 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -5,6 +5,10 @@
 %global POLICYCOREUTILSVER 2.1.12-5
 %global gettext_domain ipa
 
+%if (0%{?fedora} > 15 || 0%{?rhel} >= 7)
+%define _hardened_build 1
+%endif
+
 Name:           freeipa
 Version:        __VERSION__
 Release:        __RELEASE__%{?dist}