From: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Tue, 5 Mar 2019 10:03:59 +0000 (+0100)
Subject: docs: add a note about compilation options
X-Git-Tag: v242-rc1~195
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=57903f93c96e0751a3235f425173122d512ad912;p=thirdparty%2Fsystemd.git

docs: add a note about compilation options

Closes #6371.
---

diff --git a/docs/DISTRO_PORTING.md b/docs/DISTRO_PORTING.md
index 0099a1334ae..620e47e823c 100644
--- a/docs/DISTRO_PORTING.md
+++ b/docs/DISTRO_PORTING.md
@@ -31,6 +31,20 @@ distribution:
    print the initial transaction it would execute during boot-up.
    This will also inform you about ordering loops and suchlike.
 
+## Compilation options
+
+The default configuration does not enable any optimization or hardening
+options. This is suitable for development and testing, but not for end-user
+installations.
+
+For deployment, optimization (`-O2` or `-O3` compiler options), link time
+optimization (`-Db_lto=true` meson option), and hardening (e.g.
+`-D_FORTIFY_SOURCE=2`, `-fstack-protector-strong`, `-fstack-clash-protection`,
+`-fcf-protection`, `-pie` compiler options, and `-z relro`, `-z now`,
+`--as-needed` linker options) are recommended. The most appropriate set of
+options depends on the architecture and distribution specifics so no default is
+provided.
+
 ## NTP Pool
 
 By default, systemd-timesyncd uses the Google Public NTP servers