security_flags: Add the compiler and linker flags that enhance security
PATCH 1/1 security_flags: Add the compiler and linker flags that enhance security
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
[YOCTO #3868]
--- meta/conf/distro/include/security_flags.inc | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 meta/conf/distro/include/security_flags.inc
meta/conf/distro/include/security_flags.inc new file +21 -0
@@ -0,0 +1,21 @@ +SECURITY_CFLAGS = "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" +SECURITY_LDFLAGS = "-Wl,-z,relro,-z,now" + +#TARGET_CPPFLAGS_pn-curl += "-D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-curl = "-fstack-protector-all -pie -fpie" +SECURITY_CFLAGS_pn-ppp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-eglibc = "" +SECURITY_CFLAGS_pn-eglibc-initial = "" +SECURITY_CFLAGS_pn-zlib = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-gcc-runtime = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libgcc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-tcl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libcap = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-smartpm = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-imaging = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-pycurl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-kexec-tools = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +# These flags seem to +SECURITY_CFLAGS_pn-pulseaudio = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-ltp = "-fstack-protector-all -D_FORTIFY_SOURCE=2"
Signature · 1 line
1.8.1.4
Quoted 23 lines · Saul Wold
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
[YOCTO #3868]
Signed-off-by Saul Wold <[email protected]>--- meta/conf/distro/include/security_flags.inc | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)create mode 100644 meta/conf/distro/include/security_flags.inc
meta/conf/distro/include/security_flags.inc new file +0
-0
meta/conf/distro/include/security_flags.inc line 2
Quoted 2 lines
meta/conf/distro/include/security_flags.inc new file +2
-0@@ -0,0 +1,21 @@ +SECURITY_CFLAGS = "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" +SECURITY_LDFLAGS = "-Wl,-z,relro,-z,now"
Where do the flags get introduced into the actual CFLAGS and LDFLAGS? Would it make sense to add this to the existing BUILD_OPTIMIZATION settings.. So they would always be available, and someone could just flip a switch to enable it?
meta/conf/distro/include/security_flags.inc line 8
Quoted 6 lines
meta/conf/distro/include/security_flags.inc new file +6
-0+ +#TARGET_CPPFLAGS_pn-curl += "-D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-curl = "-fstack-protector-all -pie -fpie" +SECURITY_CFLAGS_pn-ppp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-eglibc = "" +SECURITY_CFLAGS_pn-eglibc-initial = ""
I know why you don't use them on -initial, but any reason to not enable this on 'eglibc'? If it doesn't work, it would be good to enhance eglibc's recipe to spit out a warning and sanitize the build like it does for -O0.
--Mark
Quoted 14 lines
meta/conf/distro/include/security_flags.inc new file +13
-0+SECURITY_CFLAGS_pn-zlib = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-gcc-runtime = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libgcc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-tcl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libcap = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-smartpm = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-imaging = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-pycurl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-kexec-tools = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +# These flags seem to +SECURITY_CFLAGS_pn-pulseaudio = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-ltp = "-fstack-protector-all -D_FORTIFY_SOURCE=2"
Quoted 18 lines · Mark Hatle
Quoted 17 lines · Saul Wold
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
[YOCTO #3868]
Signed-off-by Saul Wold <[email protected]>--- meta/conf/distro/include/security_flags.inc | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)create mode 100644 meta/conf/distro/include/security_flags.inc
Quoted 15 lines
meta/conf/distro/include/security_flags.inc line 2
Quoted 9 lines
meta/conf/distro/include/security_flags.inc new file +2
-0@@ -0,0 +1,21 @@ +SECURITY_CFLAGS = "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" +SECURITY_LDFLAGS = "-Wl,-z,relro,-z,now"Where do the flags get introduced into the actual CFLAGS and LDFLAGS? Would it make sense to add this to the existing
BUILD_OPTIMIZATIONsettings.. So they would always be available, and someone could just flip a switch to enable it?
Opps, sorry forgot to send part 2!
Sau!
Quoted 41 lines
meta/conf/distro/include/security_flags.inc line 8
Quoted 6 lines
meta/conf/distro/include/security_flags.inc new file +6
-0+ +#TARGET_CPPFLAGS_pn-curl += "-D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-curl = "-fstack-protector-all -pie -fpie" +SECURITY_CFLAGS_pn-ppp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-eglibc = "" +SECURITY_CFLAGS_pn-eglibc-initial = ""I know why you don't use them on -initial, but any reason to not enable this on 'eglibc'? If it doesn't work, it would be good to enhance eglibc's recipe to spit out a warning and sanitize the build like it does for -O0.
--Mark
Quoted 10 lines
meta/conf/distro/include/security_flags.inc new file +7
-2+SECURITY_CFLAGS_pn-zlib = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-gcc-runtime = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libgcc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-tcl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libcap = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-smartpm = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-imaging = "-fstack-protector-allmeta/conf/distro/include/security_flags.inc
Quoted 10 lines
meta/conf/distro/include/security_flags.inc new file +6
-4-D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-pycurl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-kexec-tools = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +# These flags seem to +SECURITY_CFLAGS_pn-pulseaudio = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-ltp = "-fstack-protector-all -D_FORTIFY_SOURCE=2"_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core