build(linux): enable full RELRO, stack canaries, and _FORTIFY_SOURCE=3

[robobun]

Tranche 1 of Linux binary hardening: the three mitigations that work unchanged under the existing -no-pie link. PIE/ASLR is intentionally left out (separate change; see the tranche header comment added to flags.ts for the .rodata vtable / deps-rebuild trade to measure).

Truth table

scripts/verify-hardening.sh build/release/bun on stock 1.4.0-canary.1+df6c7eed6 (readelf + live /proc/self/maps):

  CONTROL    STATE  EVIDENCE
  PIE        OFF    ELF type=EXEC, image base=00200000 (identical across runs)
  RELRO      OFF    GNU_RELRO=0 BIND_NOW=0 PLT=428
  CANARY     OFF    __stack_chk_fail imports=0
  FORTIFY    OFF    *_chk imports=0
  CET        OFF    no .note.gnu.property x86 feature
  NX         ON     GNU_STACK=RW
  JIT-W^X    OFF    rwx maps=1 (1024 MB [anon:JSJITCode])

FAIL: PIE RELRO CANARY FORTIFY CET JIT-W^X

Source anchors: -fno-pic/-fno-pie at scripts/build/flags.ts:639; -fno-pic/-Wl,-no-pie at :1224 (desc "No PIE (we don't need ASLR; simpler codegen)"); -z lazy/-z norelro at :1237-1238; ASLR-off rationale at scripts/build/deps/webkit.ts:240-248. No -fstack-protector*, _FORTIFY_SOURCE, or -fcf-protection anywhere in scripts/build/.

Changes

• Link: -Wl,-z,relro -Wl,-z,now instead of -Wl,-z,lazy -Wl,-z,norelro. 428 PLT slots + 59 non-PLT RELA eager-bound at startup; ld.so then remaps .got/.got.plt/.data.rel.ro read-only so a write-what-where can't retarget a libc call.
• Compile (globalFlags, so direct deps like boringssl/libarchive get coverage too): -fstack-protector-strong on unix; -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 on linux release !asan. Rust side is unchanged (would need -Zstack-protector separately).
• Strip: linux now uses llvm-strip instead of GNU strip. GNU strip's -R <section> rewrites the program-header table from sections and drops PT_GNU_RELRO, so without this the shipped binary shows BIND_NOW but no GNU_RELRO segment and ld.so never does the RO remap. llvm-strip keeps PT_GNU_RELRO; the cost is that it zeroes removed sections in place rather than compacting LOAD[0], leaving ~828 KB of zero-filled RO gap where .eh_frame was. That gap is never faulted at runtime.
• scripts/verify-hardening.sh <binary>: prints the table above + a PASS/FAIL set (exit status = FAIL count). The thing to run against release builds.

After

  CONTROL    STATE  EVIDENCE
  PIE        OFF    ELF type=EXEC, image base=00200000
  RELRO      full   GNU_RELRO=1 BIND_NOW=2 PLT=403
  CANARY     ON     __stack_chk_fail imports=1
  FORTIFY    ON     *_chk imports=17
  CET        OFF    no .note.gnu.property x86 feature
  NX         ON     GNU_STACK=RW
  JIT-W^X    OFF    rwx maps=1 ([anon:JSJITCode])

FAIL: PIE CET JIT-W^X

Binary size 72.5 MB -> 73.3 MB (+1.1%, entirely the llvm-strip gap). bun --revision, a fetch smoke, and test/js/bun/util/which.test.ts pass on the patched release build.

---

no test proof · iteration 8 · Platform-specific test(s) that do not run on this machine. Deferring to CI, which covers all platforms: test/bundler/bun-build-compile.test.ts test/cli/binary-hardening.test.ts

Code fixed along the way

Enabling these flags surfaced three latent issues; each is fixed here rather than suppressed.

• packages/bun-usockets/src/bsd.c: bionic's fortified open() wrapper flags a mode argument passed without O_CREAT. Dropped the superfluous 0700 on an O_PATH|O_DIRECTORY open.
• src/jsc/bindings/BunProcess.cpp: getgroups() gains warn_unused_result under _FORTIFY_SOURCE. The fill call's return was discarded, which also meant a TOCTOU between the size probe and the fill would read uninitialized gid_ts. Now checked and the result array is sized from the actual count.
• src/exe_format/elf.rs: -z relro -z now makes lld emit two PF_W PT_LOAD segments (RELRO first, .data/.bss second). write_bun_section() picked the first, then relocated and zero-filled everything past it as non-ALLOC tail, which destroyed the entire .data segment and left its p_offset stale. bun build --compile output segfaulted in the first constructor touching a .data static (pthread_mutex_lock(m=0x598) in mimalloc init). Now selects the PF_W PT_LOAD with the highest file end and asserts it is the last PT_LOAD. Single-RW-segment binaries behave as before.

Binary size (CI, build #82220 vs canary #79916)

target	delta	attribution
windows-x64 / windows-aarch64	+570 / +533 KB	none of these flags apply; this is main's own growth between the size baseline (ae4b17d) and this branch's base (df6c7ee, 8 commits later, including #31823 and #34598)
darwin-aarch64 / darwin-x64	+1.01 / +1.14 MB	-fstack-protector-strong prologues/epilogues + the same baseline drift
linux-x64 / aarch64 (gnu)	+1.02 MB / +917 KB	llvm-strip zero gap (~828 KB) + stack-protector + baseline drift
linux-x64 / aarch64 (musl)	+1.06 MB / +891 KB	same as gnu
linux android x64 / aarch64	+1.08 MB / +864 KB	stack-protector + FORTIFY + baseline drift (android was already PIE, no strip change)
freebsd x64 / aarch64	+1.06 MB / +928 KB	stack-protector + baseline drift

Subtracting the Windows number as baseline drift puts the per-target hardening cost at roughly +350 KB to +500 KB, plus the one-off ~828 KB llvm-strip gap on linux-gnu/musl.

[robobun]

^{Updated 4:53 AM PT - Jul 26th, 2026}

❌ @robobun, your commit d9cf132 has 2 failures in Build #82230 (All Failures):

• test/js/bun/s3/s3.test.ts - crash reported on 🐧 3.23 aarch64
• 📦 Binary size — 12 over 0.50 MB

target	this build	canary: main #79916
		size	Δ
❌ bun-darwin-aarch64	58.59 MB	57.58 MB	+1.01 MB
❌ bun-darwin-x64	64.09 MB	62.95 MB	+1.14 MB
❌ bun-linux-aarch64	71.32 MB	70.42 MB	+917.1 KB
❌ bun-linux-x64	72.97 MB	71.95 MB	+1.02 MB
❌ bun-linux-aarch64-musl	65.19 MB	64.32 MB	+891.4 KB
❌ bun-linux-x64-musl	67.51 MB	66.45 MB	+1.06 MB
❌ bun-linux-aarch64-android	78.81 MB	77.97 MB	+864.1 KB
❌ bun-linux-x64-android	81.19 MB	80.10 MB	+1.08 MB
❌ bun-freebsd-x64	83.62 MB	82.56 MB	+1.06 MB
❌ bun-freebsd-aarch64	85.21 MB	84.31 MB	+928.0 KB
❌ bun-windows-x64	80.26 MB	79.70 MB	+570.5 KB
❌ bun-windows-aarch64	70.86 MB	70.34 MB	+533.0 KB

Add [skip size check] to the commit message if this increase is intentional.

---

🧪   To try this PR locally:

bunx bun-pr 35751

That installs a local version of the PR into your bun-35751 executable, so you can run:

bun-35751 --bun

[robobun]

CI status at d9cf132 (build #82230, 143 passed with 45 still running):

• :package: binary-size is soft-failed via [skip size check]; the per-target breakdown is in the PR body.
• test/js/bun/s3/s3.test.ts on alpine aarch64 failed with S3Error ServiceUnavailable pointing at cloudflarestatus.com; the same failure is on concurrent build #82231 for an unrelated branch, so this is Cloudflare R2 being down.
• test/js/bun/http/proxy-stress-protocol.test.ts is a retry-pass flake on x64-asan.

Every lane exercising the actual changes (all linux build/test, darwin, freebsd, android, the bundler compile tests, test/cli/binary-hardening.test.ts) is green. Ready for review.