From 3bc4d117cce46fc50ab194546330e0dccc141756 Mon Sep 17 00:00:00 2001
From: lipengyu <lipengyu@kylinos.cn>
Date: Tue, 15 Apr 2025 17:55:50 +0800
Subject: [PATCH] Extend BIND_NOW to installed programs with --enable-bind-now

---
 Makeconfig          | 8 +++++---
 manual/install.texi | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/Makeconfig b/Makeconfig
index 92e76d62..71a879ed 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -398,6 +398,8 @@ endif
 # test modules.
 ifeq ($(bind-now),yes)
 LDFLAGS-lib.so += -Wl,-z,now
+# Extra flags for dynamically linked non-test main programs.
+link-extra-flags += -Wl,-z,now
 endif
 
 # Command to run after every final link (executable or shared object).
@@ -426,7 +428,7 @@ ifndef +link-pie
 	     $(link-extra-libs)
 +link-pie-after-libc = $(+postctorS) $(+postinit)
 define +link-pie
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
 $(call after-link,$@)
 endef
 define +link-pie-tests
@@ -454,7 +456,7 @@ ifndef +link-static
 	      $(link-extra-libs-static)
 +link-static-after-libc = $(+postctorT) $(+postinit)
 define +link-static
-$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)
+$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
 $(call after-link,$@)
 endef
 define +link-static-tests
@@ -485,7 +487,7 @@ else  # not build-pie-default
 	      $(link-extra-libs)
 +link-after-libc = $(+postctor) $(+postinit)
 define +link
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
+$(+link-before-libc) $(rtld-LDFLAGS)  $(link-extra-flags) $(link-libc) $(+link-after-libc)
 $(call after-link,$@)
 endef
 define +link-tests
diff --git a/manual/install.texi b/manual/install.texi
index e757891d..bed9f5b0 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -199,7 +199,7 @@ number of routines called directly from assembler are excluded from this
 protection.
 
 @item --enable-bind-now
-Disable lazy binding for installed shared objects.  This provides
+Disable lazy binding for installed shared objects and programs.  This provides
 additional security hardening because it enables full RELRO and a
 read-only global offset table (GOT), at the cost of slightly increased
 program load times.
-- 
2.23.0