Consider Wl,--as-needed and -Wl,--no-copy-dt-needed-entries for C and C++ Compiler Hardening Guide

[thomasnyman]

The Wl,--as-needed flag tells the linker to link in the produced binary only the libraries containing symbols actually used by the binary itself. This can positively impact security by reducing the attack surface of the produced binaries in terms of, e.g., gadgets available for code reuse attacks.

The Wl,--no-copy-dt-needed-entries affects the resolution of symbols in dynamic libraries by limiting the symbol resolution to the shared library expected to contain a specific symbol. This is the default in ld. Potentially the inverse, Wl,--copy-dt-needed-entries could be added as a discouraged option as that allows symbols to be resolved implicitly linked libraries in application code.

References:

• https://wiki.gentoo.org/wiki/Project:Quality_Assurance/As-needed
• https://bugzilla.redhat.com/show_bug.cgi?id=1292230