Download raw body.
PATCH: hardened build options for mozilla projects
Hi everyone,
See patch attached.
This touches Firefox, Firefox ESR, SeaMonkey and Thunderbird, in the
OpenBSD ports system. It adapts various hardened build options present
in my LibreWolf port. I've tested them all and it works perfectly on all.
Note that the Rust SIMD option (--enable-rust-simd) might fail in the
future when the rustc/cargo ports update. This option is quite sensitive
to rustc/cargo versions. Since the ports system will bulk-build these
anyway, it should be fine at the moment, and then it'll be fine again on
update.
The rust simd option is sensitive only on ESR browsers, given that they
don't change as much, but in practise it's probably fine. On regular
firefox releases for example, they regularly update themselves to handle
new rustc versions.
Beyond that, several hardening options e.g. --enable-hardening,
disabling crash reporter. I also added some CFLAGS that mitigate
undefined behaviour (e.g. undeclared local variables). All good things,
with love from LibreWolf.
I considered that OpenBSD would probably want these on other mozilla
ports. See patch!
I decided to just do one big patch for this, since it's actually quite a
trivial change.
--
Company director, Minifree Ltd
Registered in England, No. 9361826 | VAT No. GB202190462
Registered Office: 19 Hilton Road, Canvey Island, Essex SS8 9QA, UK
From 2f572868c6ed52ffadd2673c69223ed98655e534 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Thu, 3 Sep 2026 12:30:14 +0100
Subject: [PATCH 1/1] mozilla projects: add hardened build options
these are imported from the librewolf port, which are in
turn imported upstream from librewolf.
where available, rust simd extensions are also enabled.
this enables a big speed improvement on certain workloads.
options added to CFLAGS/CXXFLAGS that mitigate undefined
behaviour in some cases e.g. overflows. librewolf uses
these in its own build system.
i would have gone much deeper here, but this change is much
more conservative by comparison, in line with the seeming
light touch approach taken by Landry on the firefox port.
i've followed suit accordingly, for all mozilla projects.1
Signed-off-by: Leah Rowe <leah@libreboot.org>
---
mail/mozilla-thunderbird/Makefile | 17 ++++++++++++++---
www/firefox-esr/Makefile | 18 +++++++++++++++---
www/mozilla-firefox/Makefile | 19 ++++++++++++++++---
www/seamonkey/Makefile | 18 +++++++++++++++++-
www/tor-browser/browser/Makefile | 19 +++++++++++++++++++
5 files changed, 81 insertions(+), 10 deletions(-)
diff --git a/mail/mozilla-thunderbird/Makefile b/mail/mozilla-thunderbird/Makefile
index 83673286271..776130b1fbf 100644
--- a/mail/mozilla-thunderbird/Makefile
+++ b/mail/mozilla-thunderbird/Makefile
@@ -10,6 +10,7 @@ MOZILLA_CODENAME = comm/mail
EXTRACT_SUFX = .tar.xz
DEBUG_PACKAGES = ${BUILD_PACKAGES}
PKGNAME = ${MOZILLA_PROJECT}-${MOZILLA_VERSION:S/esr//:S/b/beta/}
+REVISION = 0
# XXX badly formed debug in libxul ?
DWZ = :
@@ -67,17 +68,27 @@ CONFIGURE_ARGS += --with-system-ffi
CONFIGURE_ARGS += --with-system-librnp
CONFIGURE_ARGS += --enable-release #1386371
+# hardening imported from the librewolf port
+CONFIGURE_ARGS += --disable-crashreporter \
+ --disable-tests \
+ --enable-hardening \
+ --enable-stl-hardening \
+ --enable-rust-simd
+
# --enable-debug does too much, this defaults to -g (which is 3 times larger than using -ggdb1)
CONFIGURE_ARGS += --disable-debug-symbols
DEBUG_CONFIGURE_ARGS += --enable-debug-symbols \
--disable-install-strip
MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}"
+# hardened flags for the build
+HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin
.if ${MACHINE_ARCH} == aarch64
# retguard leads to segfault at startup on arm64, cf #1973016
-CONFIGURE_ENV += CPPFLAGS="-fno-ret-protector -Wno-backend-plugin"
-.else
-CONFIGURE_ENV += CPPFLAGS=-Wno-backend-plugin
+HARDFLAGS += -fno-ret-protector
.endif
+CONFIGURE_ENV += CFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}"
CONFIGURE_ENV += LDFLAGS="-Wl,--threads=5 --ld-path=${WRKDIR}/bin/ld"
# #2026497
diff --git a/www/firefox-esr/Makefile b/www/firefox-esr/Makefile
index 5c3b79b6e2b..38a09525a89 100644
--- a/www/firefox-esr/Makefile
+++ b/www/firefox-esr/Makefile
@@ -7,6 +7,7 @@ MOZILLA_PROJECT = firefox-esr
MOZILLA_CODENAME = browser
MOZILLA_DIST = firefox
MOZILLA_PROFDATA_TASKID = BG92wx2xQXCqzNWrQPYftA
+REVISION = 0
WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/esr//}
HOMEPAGE = https://www.mozilla.org/firefox/organizations/
@@ -52,12 +53,14 @@ CONFIGURE_SCRIPT = ${MODPY_BIN} ${WRKSRC}/configure.py
CONFIGURE_ARGS += --prefix=${PREFIX}
CONFIGURE_ARGS += --enable-official-branding
MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}"
+HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin
.if ${MACHINE_ARCH} == aarch64
# retguard leads to segfault at startup on arm64, cf #1973016
-CONFIGURE_ENV += CPPFLAGS="-fno-ret-protector -Wno-backend-plugin"
-.else
-CONFIGURE_ENV += CPPFLAGS=-Wno-backend-plugin
+HARDFLAGS += -fno-ret-protector
.endif
+CONFIGURE_ENV += CFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}"
NCPU !!= sysctl -n hw.ncpuonline
.if ${NCPU} > 4
CONFIGURE_ENV += LDFLAGS="-Wl,--threads=5 --ld-path=${WRKDIR}/bin/ld"
@@ -81,6 +84,15 @@ CONFIGURE_ARGS += --with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot
CONFIGURE_ARGS += --enable-lto=thin
.endif
+# hardening imported from the librewolf port
+CONFIGURE_ARGS += --disable-crashreporter \
+ --disable-default-browser-agent \
+ --disable-tests \
+ --disable-cargo-incremental \
+ --enable-hardening \
+ --enable-stl-hardening \
+ --enable-rust-simd
+
# XXX badly formed debug
DWZ = :
DEBUG_PACKAGES = ${BUILD_PACKAGES}
diff --git a/www/mozilla-firefox/Makefile b/www/mozilla-firefox/Makefile
index bb0f85b5c62..5e57b8f00e6 100644
--- a/www/mozilla-firefox/Makefile
+++ b/www/mozilla-firefox/Makefile
@@ -8,6 +8,7 @@ MOZILLA_BRANCH = release
MOZILLA_PROJECT = firefox
MOZILLA_CODENAME = browser
MOZILLA_PROFDATA_TASKID = cNOKkWdaQfOqEzllBpy9Rw
+REVISION = 0
WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/b[0-9]*//}
HOMEPAGE = https://www.mozilla.org/firefox/
@@ -51,12 +52,15 @@ CONFIGURE_SCRIPT = ${MODPY_BIN} ${WRKSRC}/configure.py
CONFIGURE_ARGS += --prefix=${PREFIX}
CONFIGURE_ARGS += --enable-official-branding
MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}"
+# hardened flags for the build
+HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin
.if ${MACHINE_ARCH} == aarch64
# retguard leads to segfault at startup on arm64, cf #1973016
-CONFIGURE_ENV += CPPFLAGS="-fno-ret-protector -Wno-backend-plugin"
-.else
-CONFIGURE_ENV += CPPFLAGS=-Wno-backend-plugin
+HARDFLAGS += -fno-ret-protector
.endif
+CONFIGURE_ENV += CFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}"
CONFIGURE_ENV += LDFLAGS="-Wl,--threads=4 --ld-path=${WRKDIR}/bin/ld"
# 2026497
CONFIGURE_ENV += MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=none
@@ -72,6 +76,15 @@ CONFIGURE_ARGS += --with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot
CONFIGURE_ARGS += --enable-lto=thin
.endif
+# hardening imported from the librewolf port
+CONFIGURE_ARGS += --disable-crashreporter \
+ --disable-default-browser-agent \
+ --disable-tests \
+ --disable-cargo-incremental \
+ --enable-hardening \
+ --enable-stl-hardening \
+ --enable-rust-simd
+
# XXX badly formed debug ?
DWZ = :
DEBUG_PACKAGES = ${BUILD_PACKAGES}
diff --git a/www/seamonkey/Makefile b/www/seamonkey/Makefile
index 0c7756c9e48..519fffc95c6 100644
--- a/www/seamonkey/Makefile
+++ b/www/seamonkey/Makefile
@@ -10,7 +10,7 @@ MOZILLA_PROJECT = seamonkey
MOZILLA_CODENAME = comm/suite
SITES = https://archive.seamonkey-project.org/releases/${MOZILLA_DIST_VERSION}/source/
-REVISION-main = 0
+REVISION-main = 1
# unbreaks build with modern rust cf #1896958
SITES.p = https://bugzilla.mozilla.org/
@@ -67,6 +67,16 @@ BUILD_DEPENDS += devel/autoconf/2.13
# for distutils; possibly not needed any more
BUILD_DEPENDS += devel/py-setuptools
+# hardened flags for the build
+HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin
+.if ${MACHINE_ARCH} == aarch64
+# retguard may lead to segfault on arm64
+HARDFLAGS += -fno-ret-protector
+.endif
+CONFIGURE_ENV += CFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}"
+
# lld blows when linking libxul; limit threads
.if ${MACHINE_ARCH:Mi386}
CONFIGURE_ENV += LDFLAGS="-Wl,--threads=2"
@@ -86,6 +96,12 @@ CONFIGURE_ARGS += --enable-calendar
# remove post 96
CONFIGURE_ARGS += --disable-necko-wifi
+# hardening imported from the librewolf port
+CONFIGURE_ARGS += --disable-crashreporter \
+ --disable-tests \
+ --enable-hardening \
+ --enable-rust-simd
+
# XXX badly formed debug ?
DWZ = :
DEBUG_PACKAGES = ${BUILD_PACKAGES:N-lightning}
diff --git a/www/tor-browser/browser/Makefile b/www/tor-browser/browser/Makefile
index fad4ce8d13b..764670789ae 100644
--- a/www/tor-browser/browser/Makefile
+++ b/www/tor-browser/browser/Makefile
@@ -7,6 +7,7 @@ COMMENT = modified version of Firefox ESR for browsing over Tor
MOZILLA_VERSION = ${TB_VERSION}
MOZILLA_PROJECT = ${BROWSER_NAME}
MOZILLA_CODENAME = browser
+REVISION = 0
EXTRACT_SUFX = .tar.xz
@@ -77,10 +78,20 @@ NO_TEST = Yes
WRKDIST = ${WRKDIR}/${DISTNAME:S/src-//}
+# hardened flags for the build
+HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin
+.if ${MACHINE_ARCH} == aarch64
+# retguard leads to segfault at startup on arm64, cf #1973016
+HARDFLAGS += -fno-ret-protector
+.endif
+
CONFIGURE_STYLE = simple
CONFIGURE_SCRIPT = ${MODPY_BIN} ${WRKSRC}/configure.py
CONFIGURE_ARGS += --prefix=${PREFIX}
MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}"
+CONFIGURE_ENV += CFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}"
+CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}"
CONFIGURE_ENV += LDFLAGS="-Wl,--threads=${MAKE_JOBS} --ld-path=${WRKDIR}/bin/ld"
# app-name etc. for tor-browser
@@ -109,6 +120,14 @@ CONFIGURE_ARGS += --with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot
CONFIGURE_ARGS += --enable-lto=thin
.endif
+# hardening imported from the librewolf port
+CONFIGURE_ARGS += --disable-crashreporter \
+ --disable-default-browser-agent \
+ --disable-tests \
+ --disable-cargo-incremental \
+ --enable-hardening \
+ --enable-rust-simd
+
# XXX badly formed debug
DWZ = :
#DEBUG_PACKAGES = ${BUILD_PACKAGES}
--
2.47.3
PATCH: hardened build options for mozilla projects