last time I checked the Debian and Gentoo hardening guides relro/pie were standard practice. I can't remember the time we didn't use it and I've been around for a minute. this is my template for most Linux projects (except when "something else" is needed :)) ... please don't copy paste without certainty of what it does: CFLAGS_BASE := -c -O2 -Wall -Werror -Wpedantic -pipe $(CFLAGS) CFLAGS_HARD := -fPIE -Wformat-secur…
You should probably add noexecstack to your ldflags. I also only use -fstack-protector-strong and -fcf-protection as a fallback in case -fstack-protector-all and -fcf-protection=full cause crashes. I listed some more in https://news.ycombinator.com/item?id=29191311
Late but wanted to clarify/correct for posterity: the reasons why most people don't use "fstack-protector-all" everywhere are typically related to resource usage (not crashes), esp. in constrained environments. I have old hardware so I don't use it everywhere just yet.