.TH HARDENED-LD 1 "2008-01-08" "Debian Project" "Debian GNU/Linux"
.SH NAME
hardened-ld \- linker wrapper to enforce hardening toolchain improvements
.SH SYNOPSIS
.BI "export DEB_BUILD_HARDENING=1"
.br

.B ld
.I ...
.SH "DESCRIPTION"
The
.B hardened-ld
wrapper is normally used by calling
.B ld
as usual with
.B DEB_BUILD_HARDENING
set to 1. It will configure the necessary toolchain hardening
features. By default, all features are enabled. If a given feature does not
work correctly and needs to be disabled, the corresponding environment
variables mentioned below can be set to 0.

.SH ENVIRONMENT
.IP DEB_BUILD_HARDENING=1
Enable hardening features.
.IP DEB_BUILD_HARDENING_DEBUG=1
Print the full resulting gcc command line to STDERR before calling gcc.
.IP DEB_BUILD_HARDENING_RELRO=0
Don't mark ELF sections read-only after start. See README.Debian for details.
.IP DEB_BUILD_HARDENING_BINDNOW=0
Don't mark ELF loader for start-up dynamic resolution. See README.Debian for details.

.SH NOTES
System-wide settings can be added to
.IR /etc/hardening-wrapper.conf ,
one per line.

The real
.B ld
is renamed
.BR ld.real , 
and a diversion is
registered with
.BR dpkg-divert (1).
Thus
.BR hardened-ld 's
idea of the default
.B ld
is dictated by whatever package installed
.IR /usr/bin/ld .

.SH "SEE ALSO"
.BR hardened-cc (1)
.BR ld (1)