Support various -z linker options.

Fixes #35.

README.md

@@ -325,23 +325,33 @@ as sensible for historical reasons.
 * `Configuration` (`Debug`, `Release`): Specifies the overarching configuration.
   When `Release` is specified, `ReleaseMode` comes into effect. Defaults to
   `Debug`. Usually specified by the user as e.g. `dotnet build -c Release`.
-* `FastMath` (`true`, `false`): Enable/disable certain lossy floating point
-  optimizations that may not be standards-compliant. Defaults to `false`.
-* `LinkTimeOptimization` (`true`, `false`): Enable/disable link-time
-  optimization when `Configuration` is set to `Release`. Note that link-time
-  optimization is known not to work well on some targets and so should be used
-  selectively. Defaults to `false`.
 * `DebugSymbols` (`true`, `false`): Enable/disable emitting debug symbols.
   Defaults to `true` if `Configuration` is `Debug`; otherwise, `false`.
 * `ReleaseMode` (`Fast`, `Safe`, `Small`): The
   [build mode](https://ziglang.org/documentation/master/#Build-Mode) to use when
   `Configuration` is set to `Release`. Defaults to `Fast`.
+* `FastMath` (`true`, `false`): Enable/disable certain lossy floating point
+  optimizations that may not be standards-compliant. Defaults to `false`.
+* `LinkTimeOptimization` (`true`, `false`): Enable/disable link-time
+  optimization. Note that link-time optimization is known not to work well on
+  some targets and so should be used selectively. Defaults to `false`.
 * `SymbolExports` (`Used`, `All`): Specifies whether to export all public
   symbols or only those that are needed to link successfully. This only applies
   when building executables. Defaults to `Used`.
 * `SymbolVisibility` (`Default`, `Hidden`): Specifies the symbol visibility in
   C/C++ projects when `__attribute__((visibility(...)))` is not specified.
   `Default` (the default 😉) means public, while `Hidden` means private.
+* `ExecutableStack` (`true`, `false`): Enables/disables marking the stack as
+  executable for the resulting binary. Executable stack memory is a significant
+  security risk. Defaults to `false`.
+* `EagerBinding` (`true`, `false`): Enables/disables eager binding of symbols
+  when performing dynamic linking at run time. Eager binding has security
+  benefits, especially in combination with `RelocationHardening`. It is also
+  more reliable if calling external functions from signal handlers. Defaults to
+  `true`.
+* `RelocationHardening` (`true`, `false`): Enables/disables marking relocations
+  as read-only. This has security benefits, especially in combination with
+  `EagerBinding`. Defaults to `true`.
 * `Sanitizers`: A semicolon-separated list of
   [sanitizers](https://github.com/google/sanitizers) to instrument code with.
   Currently, only `thread` is supported. Unset by default.

src/samples/zigexe/zigexe.zigproj

@@ -1,5 +1,6 @@
 <Project Sdk="Vezel.Zig.Sdk">
     <PropertyGroup>
+        <ExecutableStack>true</ExecutableStack>
         <OutputType>Exe</OutputType>
     </PropertyGroup>
 

src/sdk/ZigCompile.cs

@@ -54,6 +54,12 @@ public string Configuration
     [Required]
     public bool DocumentationAnalysis { get; set; }
 
+    [Required]
+    public bool EagerBinding { get; set; }
+
+    [Required]
+    public bool ExecutableStack { get; set; }
+
     [Required]
     public bool FastMath { get; set; }
 
@@ -94,6 +100,9 @@ public string ReleaseMode
         set => _releaseMode = (ZigReleaseMode)Enum.Parse(typeof(ZigReleaseMode), value);
     }
 
+    [Required]
+    public bool RelocationHardening { get; set; }
+
     [Required]
     public ITaskItem[] Sanitizers { get; set; } = null!;
 
@@ -540,6 +549,16 @@ void TryAppendWarningSwitch(string name)
             foreach (var prelude in PreludeHeaders)
                 builder.AppendSwitchIfNotNull("-include ", prelude);
 
+        if (EagerBinding)
+            builder.AppendSwitch(isZig ? "-z now" : "-Wl,-z,now");
+
+        if (RelocationHardening)
+            builder.AppendSwitch(isZig ? "-z relro" : "-Wl,-z,relro");
+
+        if (!ExecutableStack)
+            builder.AppendSwitch(isZig ? "-z noexecstack" : "-Wl,-z,noexecstack");
+
+        builder.AppendSwitch(isZig ? "-z origin" : "-Wl,-z,origin");
         builder.AppendSwitchIfNotNull(isZig ? "-rpath " : "-Wl,-rpath,", "$ORIGIN");
 
         // TODO: https://github.com/vezel-dev/zig-sdk/issues/8

src/sdk/build/Vezel.Zig.Sdk.Build.targets

@@ -52,7 +52,9 @@
                     Deterministic="$(Deterministic)"
                     DisableWarnings="$(DisableWarnings)"
                     DocumentationAnalysis="$(DocumentationAnalysis)"
+                    EagerBinding="$(EagerBinding)"
                     EnvironmentVariables="ZIG_GLOBAL_CACHE_DIR=$(CachePath)/global; ZIG_LOCAL_CACHE_DIR=$(CachePath)/local"
+                    ExecutableStack="$(ExecutableStack)"
                     FastMath="$(FastMath)"
                     IncludeDirectories="@(IncludeDirectory)"
                     LanguageStandard="$(LanguageStandard)"
@@ -64,6 +66,7 @@
                     PublicIncludeDirectory="$(PublicHeadersPath)"
                     PreludeHeaders="@(PreludeHeader)"
                     ReleaseMode="$(ReleaseMode)"
+                    RelocationHardening="$(RelocationHardening)"
                     Sanitizers="$(Sanitizers)"
                     Sources="@(Compile)"
                     SymbolExports="$(SymbolExports)"

src/sdk/build/Vezel.Zig.Sdk.Defaults.targets

@@ -52,10 +52,13 @@
     </PropertyGroup>
 
     <PropertyGroup>
+        <EagerBinding Condition="'$(EagerBinding)' == ''">true</EagerBinding>
+        <ExecutableStack Condition="'$(ExecutableStack)' == ''">false</ExecutableStack>
         <FastMath Condition="'$(FastMath)' == ''">false</FastMath>
         <!-- TODO: https://github.com/vezel-dev/zig-sdk/issues/33 -->
         <LinkTimeOptimization Condition="'$(LinkTimeOptimization)' == ''">false</LinkTimeOptimization>
         <ReleaseMode Condition="'$(ReleaseMode)' == ''">Fast</ReleaseMode>
+        <RelocationHardening Condition="'$(RelocationHardening)' == ''">true</RelocationHardening>
         <SymbolExports Condition="'$(SymbolExports)' == ''">Used</SymbolExports>
         <SymbolVisibility Condition="'$(SymbolVisibility)' == ''">Default</SymbolVisibility>
     </PropertyGroup>

src/sdk/build/Vezel.Zig.Sdk.Test.targets

@@ -28,7 +28,9 @@
                     Deterministic="$(Deterministic)"
                     DisableWarnings="$(DisableWarnings)"
                     DocumentationAnalysis="$(DocumentationAnalysis)"
+                    EagerBinding="$(EagerBinding)"
                     EnvironmentVariables="ZIG_GLOBAL_CACHE_DIR=$(CachePath)/global; ZIG_LOCAL_CACHE_DIR=$(CachePath)/local"
+                    ExecutableStack="$(ExecutableStack)"
                     FastMath="$(FastMath)"
                     IncludeDirectories="@(IncludeDirectory)"
                     LanguageStandard="$(LanguageStandard)"
@@ -40,6 +42,7 @@
                     PreludeHeaders="@(PreludeHeader)"
                     PublicIncludeDirectory="$(PublicHeadersPath)"
                     ReleaseMode="$(ReleaseMode)"
+                    RelocationHardening="$(RelocationHardening)"
                     Sanitizers="$(Sanitizers)"
                     Sources="@(Compile)"
                     SymbolExports="$(SymbolExports)"