CMakeLists.txt: only pass -z relro,-z now to ELF linkers

8716c87 added -Wl,-z,relro,-z,now unconditionally, but macOS ld64 does
not support -z ("ld: unknown options: -z -z"), breaking the link on
macOS. Gate the flag on NOT APPLE; RELRO/BIND_NOW are ELF hardening
concepts with no Mach-O equivalent, and macOS builds PIE by default.

Author: aarond10

CMakeLists.txt

@@ -35,7 +35,10 @@ string(APPEND CMAKE_C_FLAGS " -fstack-protector-strong -D_FORTIFY_SOURCE=3 -fPIE
 set(CMAKE_C_FLAGS_DEBUG "-gdwarf-4 -DDEBUG")
 set(CMAKE_C_FLAGS_RELEASE "-O2")
 
-set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fPIE -Wl,-z,relro,-z,now")
+set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fPIE")
+if (NOT APPLE)  # ld64 doesn't support -z; PIE binaries are the macOS default anyway
+set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
+endif()
 
 if (CMAKE_C_COMPILER_ID MATCHES GNU)
 string(APPEND CMAKE_C_FLAGS " -Warray-bounds=2 -Wduplicated-cond -Wduplicated-branches -Wrestrict")