# linker: Enable full RELRO by default · gitcafe/zig

[View on GitCafe](https://git.cafe/gitcafe/zig/commit/33817794268b5453794f98ee752403ff44693112)

Repository: [gitcafe/zig](https://git.cafe/gitcafe/zig)

Visibility: public

Requested revision: 33817794268b5453794f98ee752403ff44693112

Requested commit: 33817794268b5453794f98ee752403ff44693112

Commit: 33817794268b5453794f98ee752403ff44693112

Tree: 5d869719d15d72fb2e14bfdbe5cf32c46ce091ec

Author: Isaac Freund

Committer: Isaac Freund

## Message

```
linker: Enable full RELRO by default

Full RELRO is a hardening feature that makes it impossible to perform
certian attacks involving overwriting parts of the Global Offset Table
to invoke arbitrary code.

It requires all symbols to be resolved before execution of the program
starts which may have an impact on startup time. However most if
not all popular Linux distributions enable full RELRO by default for
all binaries and this does not seem to make a noticeable difference
in practice.

"Partial RELRO" is equivalent to `-z relro -z lazy`.
"Full RELRO" is equivalent to `-z relro -z now`.

LLD defaults to `-z relro -z lazy`, which means Zig's current `-z relro`
option has no effect on LLD's behavior.

The changes made by this commit are as follows:

- Document that `-z relro` is the default and add `-z norelro`.
- Pass `-z now` to LLD by default to enable full RELRO by default.
- Add `-z lazy` to disable passing `-z now`.

```

## Parents

- [61844b6bd405b4cca3ab673284609aa6a651d506](https://git.cafe/gitcafe/zig/commit/61844b6bd405b4cca3ab673284609aa6a651d506?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zig/tree/33817794268b5453794f98ee752403ff44693112?format=markdown)