Nginx with-cc-opt and with-ld-opt configure options

Question

When I run nginx -V I get something like this in the output.

--with-ld-opt='-lrt -ljemalloc -Wl,-z,relro' --with-cc-opt='-m64 -mtune=native -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-sign-compare -Wno-string-plus-int -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-c++11-extensions -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion'

What is this and how to know which values need to go here when compiling nginx from source code ?

Answer 1

Out of the box you probably do not need to provide any flags yourself, the configure script should detect automatically some reasonable defaults.

However, in order to optimize for speed and/or security, you should probably provide a few compiler flags. Red Hat published an article about the flag collections they consider good. The flags starting with -Wl are used by the linker, so you should provide them using --with-ld-opt. E.g. -Wl,-pie would become --with-ld-opt="-pie".

Another reasonable way to do it would be to copy the options used by your distribution provided packages. The maintainer probably knows what he was doing, and you at least know it works for your use case.

Answer 2

This Nginx option shows configuration options (needed to set-up your compilator and linker):

-V            : show version and configure options then exit

As this documentation page says -> http://nginx.org/en/docs/configure.html:

--with-ld-opt=parameters — sets additional parameters that will be used during linking. 
--with-cc-opt=parameters — sets additional parameters that will be added to the CFLAGS variable. 

So first ones are what you want to add to a linker (ld), second is intended for a compiler (cc, gcc, etc.). For more information about these options refer gcc man page: https://linux.die.net/man/1/gcc

Answer 3

When you enter the following command:
nginx -V -h
where:
-V: : show version and configure options then exit
So you can configure your build accordingly using various parameters. The build can be configured using the configure command.

--sbin-path=path — sets the name of an nginx executable file. This name is used only during installation. By default the file is named prefix/sbin/nginx.

--conf-path=path — sets the name of an nginx.conf configuration file. If needs be, nginx can always be started with a different configuration file, by specifying it in the command-line parameter -c file. By default the file is named prefix/conf/nginx.conf.

--pid-path=path — sets the name of an nginx.pid file that will store the process ID of the main process. After installation, the file name can always be changed in the nginx.conf configuration file using the pid directive. By default the file is named prefix/logs/nginx.pid.

--error-log-path=path — sets the name of the primary error, warnings, and diagnostic file. After installation, the file name can always be changed in the nginx.conf configuration file using the error_log directive. By default the file is named prefix/logs/error.log.

--http-log-path=path — sets the name of the primary request log file of the HTTP server. After installation, the file name can always be changed in the nginx.conf configuration file using the access_log directive. By default the file is named prefix/logs/access.log.

--build=name — sets an optional nginx build name.

--user=name — sets the name of an unprivileged user whose credentials will be used by worker processes. After installation, the name can always be changed in the nginx.conf configuration file using the user directive. The default user name is nobody.

--group=name — sets the name of a group whose credentials will be used by worker processes. After installation, the name can always be changed in the nginx.conf configuration file using the user directive. By default, a group name is set to the name of an unprivileged user.

--with-select_module
--without-select_module — enables or disables building a module that allows the server to work with the select() method. This module is built automatically if the platform does not appear to support more appropriate methods such as kqueue, epoll, or /dev/poll.

--with-poll_module
--without-poll_module — enables or disables building a module that allows the server to work with the poll() method. This module is built automatically if the platform does not appear to support more appropriate methods such as kqueue, epoll, or /dev/poll.

--without-http_gzip_module — disables building a module that compresses responses of an HTTP server. The zlib library is required to build and run this module.

--without-http_rewrite_module — disables building a module that allows an HTTP server to redirect requests and change URI of requests. The PCRE library is required to build and run this module.

--without-http_proxy_module — disables building an HTTP server proxying module.

--with-http_ssl_module — enables building a module that adds the HTTPS protocol support to an HTTP server. This module is not built by default. The OpenSSL library is required to build and run this module.

--with-pcre=path — sets the path to the sources of the PCRE library. The library distribution (version 4.4 — 8.41) needs to be downloaded from the PCRE site and extracted. The rest is done by nginx’s ./configure and make. The library is required for regular expressions support in the location directive and for the ngx_http_rewrite_module module.

--with-pcre-jit — builds the PCRE library with “just-in-time compilation” support (1.1.12, the pcre_jit directive).

--with-zlib=path — sets the path to the sources of the zlib library. The library distribution (version 1.1.3 — 1.2.11) needs to be downloaded from the zlib site and extracted. The rest is done by nginx’s ./configure and make. The library is required for the ngx_http_gzip_module module.

--with-cc-opt=parameters — sets additional parameters that will be added to the CFLAGS variable. When using the system PCRE library under FreeBSD, --with-cc-opt="-I /usr/local/include" should be specified. If the number of files supported by select() needs to be increased it can also be specified here such as this: --with-cc-opt="-D FD_SETSIZE=2048".

--with-ld-opt=parameters — sets additional parameters that will be used during linking. When using the system PCRE library under FreeBSD, --with-ld-opt="-L /usr/local/lib" should be specified.`

Configure according to your need and wherever you are stuck just add -h for getting the information about a particular argument in your configuration.