Skip to content

Commit 1feb745

Browse files
tianontianon
authored
Merge pull request #340 from infosiftr/cflagz
Add cflags and ldflags for security and portability
2 parents c0bef1c + 0311282 commit 1feb745

File tree

23 files changed

+230
-0
lines changed

23 files changed

+230
-0
lines changed

‎5.6/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3232
##<autogenerated>##
3333
##</autogenerated>##
3434

35+
# Apply stack smash protection to functions using local buffers and alloca()
36+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
37+
# Enable optimization (-O2)
38+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
39+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
40+
# https://github.com/docker-library/php/issues/272
41+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
42+
ENV CPPFLAGS="$CFLAGS"
43+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
44+
3545
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
3646

3747
ENV PHP_VERSION 5.6.28

‎5.6/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3737
##<autogenerated>##
3838
##</autogenerated>##
3939

40+
# Apply stack smash protection to functions using local buffers and alloca()
41+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
42+
# Enable optimization (-O2)
43+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
44+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
45+
# https://github.com/docker-library/php/issues/272
46+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
47+
ENV CPPFLAGS="$CFLAGS"
48+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
49+
4050
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
4151

4252
ENV PHP_VERSION 5.6.28

‎5.6/apache/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,16 @@ ENV PHP_EXTRA_BUILD_DEPS apache2-dev
8888
ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2
8989
##</autogenerated>##
9090

91+
# Apply stack smash protection to functions using local buffers and alloca()
92+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
93+
# Enable optimization (-O2)
94+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
95+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
96+
# https://github.com/docker-library/php/issues/272
97+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
98+
ENV CPPFLAGS="$CFLAGS"
99+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
100+
91101
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
92102

93103
ENV PHP_VERSION 5.6.28

‎5.6/fpm/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3333
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data
3434
##</autogenerated>##
3535

36+
# Apply stack smash protection to functions using local buffers and alloca()
37+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
38+
# Enable optimization (-O2)
39+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
40+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
41+
# https://github.com/docker-library/php/issues/272
42+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
43+
ENV CPPFLAGS="$CFLAGS"
44+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
45+
3646
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
3747

3848
ENV PHP_VERSION 5.6.28

‎5.6/fpm/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3838
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data
3939
##</autogenerated>##
4040

41+
# Apply stack smash protection to functions using local buffers and alloca()
42+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
43+
# Enable optimization (-O2)
44+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
45+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
46+
# https://github.com/docker-library/php/issues/272
47+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
48+
ENV CPPFLAGS="$CFLAGS"
49+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
50+
4151
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
4252

4353
ENV PHP_VERSION 5.6.28

‎5.6/zts/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3333
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-maintainer-zts
3434
##</autogenerated>##
3535

36+
# Apply stack smash protection to functions using local buffers and alloca()
37+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
38+
# Enable optimization (-O2)
39+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
40+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
41+
# https://github.com/docker-library/php/issues/272
42+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
43+
ENV CPPFLAGS="$CFLAGS"
44+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
45+
3646
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
3747

3848
ENV PHP_VERSION 5.6.28

‎5.6/zts/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3838
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-maintainer-zts
3939
##</autogenerated>##
4040

41+
# Apply stack smash protection to functions using local buffers and alloca()
42+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
43+
# Enable optimization (-O2)
44+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
45+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
46+
# https://github.com/docker-library/php/issues/272
47+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
48+
ENV CPPFLAGS="$CFLAGS"
49+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
50+
4151
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
4252

4353
ENV PHP_VERSION 5.6.28

‎7.0/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3232
##<autogenerated>##
3333
##</autogenerated>##
3434

35+
# Apply stack smash protection to functions using local buffers and alloca()
36+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
37+
# Enable optimization (-O2)
38+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
39+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
40+
# https://github.com/docker-library/php/issues/272
41+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
42+
ENV CPPFLAGS="$CFLAGS"
43+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
44+
3545
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
3646

3747
ENV PHP_VERSION 7.0.13

‎7.0/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3737
##<autogenerated>##
3838
##</autogenerated>##
3939

40+
# Apply stack smash protection to functions using local buffers and alloca()
41+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
42+
# Enable optimization (-O2)
43+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
44+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
45+
# https://github.com/docker-library/php/issues/272
46+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
47+
ENV CPPFLAGS="$CFLAGS"
48+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
49+
4050
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
4151

4252
ENV PHP_VERSION 7.0.13

‎7.0/apache/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,16 @@ ENV PHP_EXTRA_BUILD_DEPS apache2-dev
8888
ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2
8989
##</autogenerated>##
9090

91+
# Apply stack smash protection to functions using local buffers and alloca()
92+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
93+
# Enable optimization (-O2)
94+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
95+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
96+
# https://github.com/docker-library/php/issues/272
97+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
98+
ENV CPPFLAGS="$CFLAGS"
99+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
100+
91101
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
92102

93103
ENV PHP_VERSION 7.0.13

‎7.0/fpm/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3333
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data
3434
##</autogenerated>##
3535

36+
# Apply stack smash protection to functions using local buffers and alloca()
37+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
38+
# Enable optimization (-O2)
39+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
40+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
41+
# https://github.com/docker-library/php/issues/272
42+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
43+
ENV CPPFLAGS="$CFLAGS"
44+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
45+
3646
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
3747

3848
ENV PHP_VERSION 7.0.13

‎7.0/fpm/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3838
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data
3939
##</autogenerated>##
4040

41+
# Apply stack smash protection to functions using local buffers and alloca()
42+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
43+
# Enable optimization (-O2)
44+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
45+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
46+
# https://github.com/docker-library/php/issues/272
47+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
48+
ENV CPPFLAGS="$CFLAGS"
49+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
50+
4151
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
4252

4353
ENV PHP_VERSION 7.0.13

‎7.0/zts/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3333
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-maintainer-zts
3434
##</autogenerated>##
3535

36+
# Apply stack smash protection to functions using local buffers and alloca()
37+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
38+
# Enable optimization (-O2)
39+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
40+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
41+
# https://github.com/docker-library/php/issues/272
42+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
43+
ENV CPPFLAGS="$CFLAGS"
44+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
45+
3646
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
3747

3848
ENV PHP_VERSION 7.0.13

‎7.0/zts/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3838
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-maintainer-zts
3939
##</autogenerated>##
4040

41+
# Apply stack smash protection to functions using local buffers and alloca()
42+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
43+
# Enable optimization (-O2)
44+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
45+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
46+
# https://github.com/docker-library/php/issues/272
47+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
48+
ENV CPPFLAGS="$CFLAGS"
49+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
50+
4151
ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763
4252

4353
ENV PHP_VERSION 7.0.13

‎7.1/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3232
##<autogenerated>##
3333
##</autogenerated>##
3434

35+
# Apply stack smash protection to functions using local buffers and alloca()
36+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
37+
# Enable optimization (-O2)
38+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
39+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
40+
# https://github.com/docker-library/php/issues/272
41+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
42+
ENV CPPFLAGS="$CFLAGS"
43+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
44+
3545
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
3646

3747
ENV PHP_VERSION 7.1.0

‎7.1/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3737
##<autogenerated>##
3838
##</autogenerated>##
3939

40+
# Apply stack smash protection to functions using local buffers and alloca()
41+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
42+
# Enable optimization (-O2)
43+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
44+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
45+
# https://github.com/docker-library/php/issues/272
46+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
47+
ENV CPPFLAGS="$CFLAGS"
48+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
49+
4050
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
4151

4252
ENV PHP_VERSION 7.1.0

‎7.1/apache/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,16 @@ ENV PHP_EXTRA_BUILD_DEPS apache2-dev
8888
ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2
8989
##</autogenerated>##
9090

91+
# Apply stack smash protection to functions using local buffers and alloca()
92+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
93+
# Enable optimization (-O2)
94+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
95+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
96+
# https://github.com/docker-library/php/issues/272
97+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
98+
ENV CPPFLAGS="$CFLAGS"
99+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
100+
91101
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
92102

93103
ENV PHP_VERSION 7.1.0

‎7.1/fpm/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3333
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data
3434
##</autogenerated>##
3535

36+
# Apply stack smash protection to functions using local buffers and alloca()
37+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
38+
# Enable optimization (-O2)
39+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
40+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
41+
# https://github.com/docker-library/php/issues/272
42+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
43+
ENV CPPFLAGS="$CFLAGS"
44+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
45+
3646
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
3747

3848
ENV PHP_VERSION 7.1.0

‎7.1/fpm/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3838
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data
3939
##</autogenerated>##
4040

41+
# Apply stack smash protection to functions using local buffers and alloca()
42+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
43+
# Enable optimization (-O2)
44+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
45+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
46+
# https://github.com/docker-library/php/issues/272
47+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
48+
ENV CPPFLAGS="$CFLAGS"
49+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
50+
4151
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
4252

4353
ENV PHP_VERSION 7.1.0

‎7.1/zts/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3333
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-maintainer-zts
3434
##</autogenerated>##
3535

36+
# Apply stack smash protection to functions using local buffers and alloca()
37+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
38+
# Enable optimization (-O2)
39+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
40+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
41+
# https://github.com/docker-library/php/issues/272
42+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
43+
ENV CPPFLAGS="$CFLAGS"
44+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
45+
3646
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
3747

3848
ENV PHP_VERSION 7.1.0

‎7.1/zts/alpine/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3838
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-maintainer-zts
3939
##</autogenerated>##
4040

41+
# Apply stack smash protection to functions using local buffers and alloca()
42+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
43+
# Enable optimization (-O2)
44+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
45+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
46+
# https://github.com/docker-library/php/issues/272
47+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
48+
ENV CPPFLAGS="$CFLAGS"
49+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
50+
4151
ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0
4252

4353
ENV PHP_VERSION 7.1.0

‎Dockerfile-alpine.template

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,16 @@ RUN mkdir -p $PHP_INI_DIR/conf.d
3131
##<autogenerated>##
3232
##</autogenerated>##
3333

34+
# Apply stack smash protection to functions using local buffers and alloca()
35+
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
36+
# Enable optimization (-O2)
37+
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
38+
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
39+
# https://github.com/docker-library/php/issues/272
40+
ENV CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
41+
ENV CPPFLAGS="$CFLAGS"
42+
ENV LDFLAGS="-Wl,-O1 -Wl,--hash-style=both"
43+
3444
ENV GPG_KEYS %%GPG_KEYS%%
3545

3646
ENV PHP_VERSION %%PHP_VERSION%%

0 commit comments

Comments
 (0)