From 70d464474234c01f9cab7599c3c6b42f3a8b1602 Mon Sep 17 00:00:00 2001
From: #DeleteGithub <biergaizi@users.noreply.github.com>
Date: Sun, 14 Oct 2018 09:47:55 +0800
Subject: [PATCH] build: enable PIE when compiling Linux builds, fix #14961.
 (#15152)

PIE allows an application to utilize the full benefits of ASLR
to prevent itself from exploitations, but it was disabled for
all released versions of Electron (3.0 and prior).

Currently, PIE is already enabled since 9294fac but enabling it
for all released version is still an ongoing work (#14961). This
patch backports PIE to the 3.0.x branch.

Signed-off-by: Tom Li <tomli@tomli.me>
---
 brightray/brightray.gyp |  2 ++
 common.gypi             |  1 +
 electron.gyp            | 11 +++++++++++
 3 files changed, 14 insertions(+)

diff --git a/brightray/brightray.gyp b/brightray/brightray.gyp
index 5b353f0a7a9b..cf87157f67f2 100644
--- a/brightray/brightray.gyp
+++ b/brightray/brightray.gyp
@@ -84,6 +84,8 @@
           },
           'cflags': [
             '<!@(<(pkg-config) --cflags <(linux_system_libraries))',
+            # Needed for PIE
+            '-fPIC',
           ],
           'direct_dependent_settings': {
             'cflags': [
diff --git a/common.gypi b/common.gypi
index 676d1e904127..bd978a813c5b 100644
--- a/common.gypi
+++ b/common.gypi
@@ -263,6 +263,7 @@
           ['OS=="linux"', {
             'cflags': [
               '-Wno-empty-body',
+              '-fPIC',
             ],
           }],  # OS=="linux"
           ['OS=="win"', {
diff --git a/electron.gyp b/electron.gyp
index a380e48cd8a2..c4467ecfb87c 100644
--- a/electron.gyp
+++ b/electron.gyp
@@ -253,6 +253,16 @@
               ],
             },
           ],
+          'link_settings': {
+            'ldflags': [
+              # Build as Position-Independent Executable to mitigate exploitations.
+              '-pie',
+            ],
+          },
+          'cflags_cc': [
+            # Needed for PIE
+            '-fPIC',
+          ]
         }],  # OS=="linux"
       ],
     },  # target <(project_name)
@@ -441,6 +451,7 @@
           # Required settings of using breakpad.
           'cflags_cc': [
             '-Wno-empty-body',
+            '-fPIC',
           ],
           'include_dirs': [
             'vendor/breakpad/src',