agent: build as Position-Independent-Executable

Build the agent binary as Position-Independent-Executable (PIE) for improved security and compliancy with distros packaging guidelines. Fixes: #408 Signed-off-by: Marco Vedovati <[email protected]>
kata-containers · Nov 6, 2018 · 8dedf30 · 8dedf30
1 parent 0f411fd
commit 8dedf30
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/Makefile b/Makefile
@@ -36,6 +36,8 @@ ARCH := $(shell go env GOARCH)
 ifeq ($(SECCOMP),yes)
 BUILDTAGS := seccomp
 endif
+# go build common flags
+BUILDFLAGS := -buildmode=pie
 
 # args for building agent image
 BUILDARGS := $(if $(http_proxy), --build-arg http_proxy=$(http_proxy))
@@ -45,7 +47,7 @@ AGENT_IMAGE := katacontainers/agent-dev
 AGENT_TAG := $(if $(COMMIT_NO_SHORT),$(COMMIT_NO_SHORT),dev)
 
 $(TARGET): $(GENERATED_FILES) $(SOURCES) $(VERSION_FILE)
-	go build -tags "$(BUILDTAGS)" -o $@ \
+	go build $(BUILDFLAGS) -tags "$(BUILDTAGS)" -o $@ \
 		-ldflags "-X main.version=$(VERSION_COMMIT) -X main.seccompSupport=$(SECCOMP)"
 
 install: