Skip to contentSkip to conversation

Add GCCPIE knob to configure gcc with --enable-default-pie

PATCH In review Khem Raj 3 participants 17 messages Jun 14, 2017 – Jun 15, 2017

lore
Share & tools
lore

Khem Raj

author
#0 lore raw

cover Add GCCPIE knob to configure gcc with --enable-default-pie

* This patchset add a switch to configure gcc driver with PIE defaults
* Add support for generating static PIE in gcc
* Gets rid of lot of bandaids from distro security flags file
* Adjust recipes for new way of specifying pie
* Upgrade and Fix mips build for ffmpeg along the way

The following changes since commit 059846662f1ea1c82804cfce5f91afcb2980ec8a:

mtools-native: fix Upstream-Status (2017-06-14 14:45:01 +0100)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib kraj/hardening-fixes
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=kraj/hardening-fixes

Khem Raj (10):
gcc: Introduce a knob to configure gcc to default to PIE security_flags.inc: Delete pinnings for SECURITY_NO_PIE_CFLAGS distutils,setuptools: Delete use of SECURITY_NO_PIE_CFLAGS
ffmpeg: Upgrade to 3.3.2 stable
gobject-introspection: Disable generating static lbraries
zlib: Pass pre-calculate uname enable re-entrant flags
gcc-sanitizer: Fix build with glibc 2.26
gcc7: Enable static PIE
libunwind: We set -fPIE in security flags now if gcc is not configured
for default PIE
valgrind: Remove -no-pie from cflags

 meta/classes/distutils-common-base.bbclass         |   2 -
 meta/classes/setuptools.bbclass                    |   2 -
 meta/conf/distro/include/security_flags.inc        |  85 ++++-------
 meta/recipes-core/zlib/zlib_1.2.11.bb              |  12 +-
 meta/recipes-devtools/gcc/gcc-7.1.inc              |   2 +
 ...r-Use-stack_t-instead-of-struct-sigaltsta.patch | 160 +++++++++++++++++++++
 .../gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch   |  37 +++++
 meta/recipes-devtools/gcc/gcc-configure-common.inc |   3 +
 meta/recipes-devtools/valgrind/valgrind_3.12.0.bb  |   1 -
 .../gobject-introspection_1.50.0.bb                |   1 +
 .../ffmpeg/ffmpeg/0001-build-fix-for-mips.patch    |  44 ++++++
 .../ffmpeg/{ffmpeg_3.3.bb => ffmpeg_3.3.2.bb}      |   5 +-
 meta/recipes-support/libunwind/libunwind_1.2.bb    |   4 -
 13 files changed, 281 insertions(+), 77 deletions(-)
 create mode 100644 meta/recipes-devtools/gcc/gcc-7.1/0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch
 create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/0001-build-fix-for-mips.patch
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_3.3.bb => ffmpeg_3.3.2.bb} (97%)
Signature · 1 line
2.13.1
author
#1 lore raw

PATCH 1/10 gcc: Introduce a knob to configure gcc to default to PIE

GCCPIE flag which is empty by default adds "--enable-default-pie" configure option for harderned distros

We do not require to add -fpie -pie flag externally anymore

Signed-off-by Khem Raj <[email protected]>
---
 meta/conf/distro/include/security_flags.inc        | 4 +++-
 meta/recipes-devtools/gcc/gcc-configure-common.inc | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)
meta/conf/distro/include/security_flags.inc +3 -1
index e162abeb3d..d3b7257240 100644
@@ -5,6 +5,8 @@
 # From a Yocto Project perspective, this file is included and tested
 # in the DISTRO="poky-lsb" configuration.
 
+GCCPIE ?= "--enable-default-pie"
+
 # _FORTIFY_SOURCE requires -O1 or higher, so disable in debug builds as they use
 # -O0 which then results in a compiler warning.
 lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}"

@@ -12,7 +14,7 @@ lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE
 # Error on use of format strings that represent possible security problems
 SECURITY_STRINGFORMAT ?= "-Wformat -Wformat-security -Werror=format-security"
 
-SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}"
+SECURITY_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}"
 SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}"
 
 SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now"
meta/recipes-devtools/gcc/gcc-configure-common.inc +3 -0
index 086525997e..af3575355c 100644
@@ -22,6 +22,8 @@ EXTRA_OECONF_INITIAL ?= ""
 GCCMULTILIB ?= "--disable-multilib"
 GCCTHREADS ?= "posix"
 
+GCCPIE ??= ""
+
 EXTRA_OECONF = "\
     ${@['--enable-clocale=generic', ''][d.getVar('USE_NLS') != 'no']} \
     --with-gnu-ld \

@@ -29,6 +31,7 @@ EXTRA_OECONF = "\
     --enable-languages=${LANGUAGES} \
     --enable-threads=${GCCTHREADS} \
     ${GCCMULTILIB} \
+    ${GCCPIE} \
     --enable-c99 \
     --enable-long-long \
     --enable-symvers=gnu \
Signature · 1 line
2.13.1
author
#2 lore raw

PATCH 2/10 security_flags.inc: Delete pinnings for SECURITY_NO_PIE_CFLAGS

In reply to Khem Raj

GCC is configured correctly to pass PIE cflags/ldflags

Signed-off-by Khem Raj <[email protected]>
---
 meta/conf/distro/include/security_flags.inc | 83 ++++++++---------------------
 1 file changed, 22 insertions(+), 61 deletions(-)
meta/conf/distro/include/security_flags.inc +22 -61
index d3b7257240..f6bbf70655 100644
@@ -1,4 +1,4 @@
-# Setup extra CFLAGS and LDFLAGS which have 'security' benefits. These 
+# Setup extra CFLAGS and LDFLAGS which have 'security' benefits. These
 # don't work universally, there are recipes which can't use one, the other
 # or both so a blacklist is maintained here. The idea would be over
 # time to reduce this list to nothing.

@@ -14,89 +14,45 @@ lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE
 # Error on use of format strings that represent possible security problems
 SECURITY_STRINGFORMAT ?= "-Wformat -Wformat-security -Werror=format-security"
 
-SECURITY_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}"
+# Inject pie flags into compiler flags if not configured with gcc itself
+# especially useful with external toolchains
+SECURITY_PIE_CFLAGS ?= "${@'' if '${GCCPIE}' else '-pie -fPIE'}"
+
+SECURITY_NOPIE_CFLAGS ?= "-no-pie -fno-PIE"
+
+SECURITY_CFLAGS ?= "-fstack-protector-strong ${SECURITY_PIE_CFLAGS} ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}"
 SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}"
 
 SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now"
 SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro"
 
 # powerpc does not get on with pie for reasons not looked into as yet
-SECURITY_CFLAGS_powerpc = "-fstack-protector-strong ${lcl_maybe_fortify}"
-# Deal with ppc specific linker failures when using the cflags
-SECURITY_CFLAGS_pn-dbus_powerpc = ""
-SECURITY_CFLAGS_pn-dbus-ptest_powerpc = ""
-SECURITY_CFLAGS_pn-libmatchbox_powerpc = ""
+SECURITY_CFLAGS_powerpc = "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_NOPIE_CFLAGS}"
+SECURITY_CFLAGS_pn-libgcc_powerpc = ""
 
 # arm specific security flag issues
-SECURITY_CFLAGS_pn-lttng-tools_arm = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-aspell = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-beecrypt = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-coreutils = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-cups = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-db = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-directfb = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-glibc = ""
 SECURITY_CFLAGS_pn-glibc-initial = ""
-SECURITY_CFLAGS_pn-elfutils = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-enchant = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-expect = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-flac = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gcc = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gcc-runtime = ""
-SECURITY_CFLAGS_pn-gcc-sanitizers = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gdb = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gmp = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gnutls = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gpgme = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-grub = ""
 SECURITY_CFLAGS_pn-grub-efi = ""
 SECURITY_CFLAGS_pn-grub-efi-native = ""
 SECURITY_CFLAGS_pn-grub-efi-x86-native = ""
 SECURITY_CFLAGS_pn-grub-efi-i586-native = ""
 SECURITY_CFLAGS_pn-grub-efi-x86-64-native = ""
-SECURITY_CFLAGS_pn-gstreamer1.0-plugins-bad = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gstreamer1.0-plugins-good = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-harfbuzz = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-kexec-tools = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-iptables = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libaio = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libcap = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libgcc = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libid3tag = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libnewt-python = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libglu = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libpcap = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libpcre = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libproxy = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-mesa = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-mesa-gl = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-openssl = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-opensp = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-ppp = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python-pycurl = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python3-numpy = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python3-pycairo = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python3-pycurl = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python3-pygpgme = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-python3 = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-syslinux = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-slang = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-source-highlight = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-uclibc = ""
 SECURITY_CFLAGS_pn-uclibc-initial = ""
-SECURITY_CFLAGS_pn-valgrind = ""
-SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
+
+SECURITY_CFLAGS_pn-mkelfimage_x86 = ""
+
+SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NOPIE_CFLAGS}"
+SECURITY_LDFLAGS_pn-valgrind = ""
 
 # Recipes which fail to compile when elevating -Wformat-security to an error
 SECURITY_STRINGFORMAT_pn-busybox = ""
 SECURITY_STRINGFORMAT_pn-gcc = ""
-SECURITY_STRINGFORMAT_pn-oh-puzzles = ""
 
-TARGET_CFLAGS_append_class-target = " ${SECURITY_CFLAGS}"
+TARGET_CC_ARCH_append_class-target = " ${SECURITY_CFLAGS}"
 TARGET_LDFLAGS_append_class-target = " ${SECURITY_LDFLAGS}"
 
 SECURITY_LDFLAGS_remove_pn-gcc-runtime = "-fstack-protector-strong"

@@ -104,6 +60,8 @@ SECURITY_LDFLAGS_remove_pn-glibc = "-fstack-protector-strong"
 SECURITY_LDFLAGS_remove_pn-glibc-initial = "-fstack-protector-strong"
 SECURITY_LDFLAGS_remove_pn-uclibc = "-fstack-protector-strong"
 SECURITY_LDFLAGS_remove_pn-uclibc-initial = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-mkelfimage_x86 = "-fstack-protector-strong"
+
 SECURITY_LDFLAGS_pn-xf86-video-fbdev = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-intel = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-omapfb = "${SECURITY_X_LDFLAGS}"

@@ -112,4 +70,7 @@ SECURITY_LDFLAGS_pn-xf86-video-vesa = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-vmware = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xserver-xorg = "${SECURITY_X_LDFLAGS}"
 
-TARGET_CC_ARCH_append_pn-binutils = " ${SECURITY_CFLAGS} ${SELECTED_OPTIMIZATION}"
+TARGET_CC_ARCH_append_pn-binutils = " ${SELECTED_OPTIMIZATION}"
+TARGET_CC_ARCH_append_pn-gcc = " ${SELECTED_OPTIMIZATION}"
+TARGET_CC_ARCH_append_pn-gdb = " ${SELECTED_OPTIMIZATION}"
+TARGET_CC_ARCH_append_pn-perf = " ${SELECTED_OPTIMIZATION}"
Signature · 1 line
2.13.1
author
#3 lore raw

PATCH 3/10 distutils, setuptools: Delete use of SECURITY_NO_PIE_CFLAGS

In reply to Khem Raj

gcc can handle PIE in gcc driver

Signed-off-by Khem Raj <[email protected]>
---
 meta/classes/distutils-common-base.bbclass | 2 --
 meta/classes/setuptools.bbclass            | 2 --
 2 files changed, 4 deletions(-)
meta/classes/distutils-common-base.bbclass +0 -2
index fa733c672c..824a1b68b1 100644
@@ -11,5 +11,3 @@ FILES_${PN}-dev += "\
   ${libdir}/pkgconfig \
   ${PYTHON_SITEPACKAGES_DIR}/*.la \
 "
-
-SECURITY_CFLAGS = "${SECURITY_NO_PIE_CFLAGS}"
meta/classes/setuptools.bbclass +0 -2
index 7d0c5267d7..56343b1c73 100644
@@ -6,5 +6,3 @@ DISTUTILS_INSTALL_ARGS = "--root=${D} \
     --prefix=${prefix} \
     --install-lib=${PYTHON_SITEPACKAGES_DIR} \
     --install-data=${datadir}"
-
-SECURITY_CFLAGS = "${SECURITY_NO_PIE_CFLAGS}"
Signature · 1 line
2.13.1
author
#4 lore raw

PATCH 4/10 ffmpeg: Upgrade to 3.3.2 stable

In reply to Khem Raj

* Fix mips/mips64 along the way, it was broken in 3.3 as well

Signed-off-by Khem Raj <[email protected]>
---
 .../ffmpeg/ffmpeg/0001-build-fix-for-mips.patch    | 44 ++++++++++++++++++++++
 .../ffmpeg/{ffmpeg_3.3.bb => ffmpeg_3.3.2.bb}      |  5 ++-
 2 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/0001-build-fix-for-mips.patch
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_3.3.bb => ffmpeg_3.3.2.bb} (97%)
meta/recipes-multimedia/ffmpeg/ffmpeg/0001-build-fix-for-mips.patch new file +44 -0
new file mode 100644
index 0000000000..3f8224aa07
@@ -0,0 +1,44 @@
+From f34c567045bea5a7ded9bcfa8e785cfd24cc7dde Mon Sep 17 00:00:00 2001
+From: Shivraj Patil <[email protected]>
+Date: Tue, 4 Apr 2017 18:56:01 +0530
+Subject: [PATCH] build fix for mips
+
+Signed-off-by: Shivraj Patil <[email protected]>
+Signed-off-by: Ronald S. Bultje <[email protected]>
+---
+Upstream-Status: Backport
+
+ libavcodec/mips/hevcpred_init_mips.c | 3 ++-
+ libavcodec/mips/hevcpred_msa.c       | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/libavcodec/mips/hevcpred_init_mips.c b/libavcodec/mips/hevcpred_init_mips.c
+index 331cfac115..e987698d66 100644
+--- a/libavcodec/mips/hevcpred_init_mips.c
++++ b/libavcodec/mips/hevcpred_init_mips.c
+@@ -18,7 +18,8 @@
+  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+  */
+ 
+-#include "libavcodec/hevc.h"
++#include "config.h"
++#include "libavutil/attributes.h"
+ #include "libavcodec/mips/hevcpred_mips.h"
+ 
+ #if HAVE_MSA
+diff --git a/libavcodec/mips/hevcpred_msa.c b/libavcodec/mips/hevcpred_msa.c
+index 6a3b2815fd..963c64c861 100644
+--- a/libavcodec/mips/hevcpred_msa.c
++++ b/libavcodec/mips/hevcpred_msa.c
+@@ -18,7 +18,7 @@
+  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+  */
+ 
+-#include "libavcodec/hevc.h"
++#include "libavcodec/hevcdec.h"
+ #include "libavutil/mips/generic_macros_msa.h"
+ #include "hevcpred_mips.h"
+ 
+-- 
+2.13.1
+
meta/recipes-multimedia/ffmpeg/ffmpeg_3.3.2.bb renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_3.3.bb +3 -2
similarity index 97%
rename from meta/recipes-multimedia/ffmpeg/ffmpeg_3.3.bb
rename to meta/recipes-multimedia/ffmpeg/ffmpeg_3.3.2.bb
index c2b570e85c..f4bb2ba1f5 100644
@@ -25,9 +25,10 @@ LIC_FILES_CHKSUM = "file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 
 SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://mips64_cpu_detection.patch \
+           file://0001-build-fix-for-mips.patch \
           "
-SRC_URI[md5sum] = "368f1fff4bdadaf2823934cc0aadd71d"
-SRC_URI[sha256sum] = "599e7f7c017221c22011c4037b88bdcd1c47cd40c1e466838bc3c465f3e9569d"
+SRC_URI[md5sum] = "d6c09c84e3d0d9ca8a51f481da660603"
+SRC_URI[sha256sum] = "1998de1ab32616cbf2ff86efc3f1f26e76805ec5dc51e24c041c79edd8262785"
 
 # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717
 ARM_INSTRUCTION_SET = "arm"
Signature · 1 line
2.13.1
author
#5 lore raw

PATCH 5/10 gobject-introspection: Disable generating static lbraries

In reply to Khem Raj
Signed-off-by Khem Raj <[email protected]>
---
 meta/recipes-gnome/gobject-introspection/gobject-introspection_1.50.0.bb | 1 +
 1 file changed, 1 insertion(+)
meta/recipes-gnome/gobject-introspection/gobject-introspection_1.50.0.bb +1 -0
index 509fc5fa59..ce31097da6 100644
@@ -99,6 +99,7 @@ EOF
 # Configure target build to use native tools of itself and to use a qemu wrapper
 # and optionally to generate introspection data
 EXTRA_OECONF_class-target += "--enable-host-gi \
+                              --disable-static \
                               --enable-gi-cross-wrapper=${B}/g-ir-scanner-qemuwrapper \
                               --enable-gi-ldd-wrapper=${B}/g-ir-scanner-lddwrapper \
                               ${@bb.utils.contains('GI_DATA_ENABLED', 'True', '--enable-introspection-data', '--disable-introspection-data', d)} \
Signature · 1 line
2.13.1
author
#7 lore raw

Re: [PATCH 05/10] gobject-introspection: Disable generating static lbraries

Quoted 7 lines · Alexander Kanavin
Quoted 2 lines · Khem Raj
Signed-off-by Khem Raj <[email protected]>

Why? You need to add an explanation to the commit message.

sure, its to avoid linking with .a when using pie

Quoted 2 lines

Alex

#8 lore raw

Re: [PATCH 05/10] gobject-introspection: Disable generating static lbraries

Quoted 10 lines · Khem Raj
Quoted 7 lines · Alexander Kanavin
Quoted 2 lines · Khem Raj
Signed-off-by Khem Raj <[email protected]>

Why? You need to add an explanation to the commit message.

sure, its to avoid linking with .a when using pie

Can you resend the patch please?

Alex

author
#9 lore raw

Re: [PATCH 05/10] gobject-introspection: Disable generating static lbraries

Quoted 12 lines · Alexander Kanavin
Quoted 11 lines · Khem Raj
Quoted 8 lines · Alexander Kanavin
Quoted 3 lines · Khem Raj
Signed-off-by Khem Raj <[email protected]>
Quoted 7 lines
Quoted 3 lines
Quoted 2 lines

Why? You need to add an explanation to the commit message.

sure, its to avoid linking with .a when using pie

Can you resend the patch please?

Updated on pull request branch
http://git.openembedded.org/openembedded-core-contrib/commit/?h=kraj/hardening-fixes&id=ea442af4b3a7669485a18d57fbb043d9093189bc

Quoted 3 lines

Alex

author
#10 lore raw

PATCH 6/10 zlib: Pass pre-calculate uname enable re-entrant flags

In reply to Khem Raj

Fix ptest generation

Signed-off-by Khem Raj <[email protected]>
---
 meta/recipes-core/zlib/zlib_1.2.11.bb | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)
meta/recipes-core/zlib/zlib_1.2.11.bb +7 -5
index d4a81820df..ba216f679a 100644
@@ -17,20 +17,22 @@ UPSTREAM_CHECK_URI = "http://zlib.net/"
 SRC_URI[md5sum] = "85adef240c5f370b308da8c938951a68"
 SRC_URI[sha256sum] = "4ff941449631ace0d4d203e3483be9dbc9da454084111f97ea0a2114e19bf066"
 
+CFLAGS += "-D_REENTRANT"
+
 RDEPENDS_${PN}-ptest += "make"
 
 inherit ptest
 
-do_configure (){
-	./configure --prefix=${prefix} --shared --libdir=${libdir}
+do_configure() {
+	uname=GNU ./configure --prefix=${prefix} --shared --libdir=${libdir}
 }
 
-do_compile (){
-	oe_runmake
+do_compile() {
+	oe_runmake shared
 }
 
 do_compile_ptest() {
-	oe_runmake static shared
+	oe_runmake test
 }
 
 do_install() {
Signature · 1 line
2.13.1
author
#11 lore raw

PATCH 7/10 gcc-sanitizer: Fix build with glibc 2.26

In reply to Khem Raj

sigaltstack is no more exposed by glibc see (bug 21517) therefore adjust to use stack_t instead

Use res_state typedef instead of referring to __res_state struct

Signed-off-by Khem Raj <[email protected]>
---
 meta/recipes-devtools/gcc/gcc-7.1.inc              |   1 +
 ...r-Use-stack_t-instead-of-struct-sigaltsta.patch | 160 +++++++++++++++++++++
 2 files changed, 161 insertions(+)
 create mode 100644 meta/recipes-devtools/gcc/gcc-7.1/0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch
meta/recipes-devtools/gcc/gcc-7.1.inc +1 -0
index 3df04199a6..77d5ac11eb 100644
@@ -78,6 +78,7 @@ SRC_URI = "\
            file://0045-Link-libgcc-using-LDFLAGS-not-just-SHLIB_LDFLAGS.patch \
            file://0046-libgcc_s-Use-alias-for-__cpu_indicator_init-instead-.patch \
            file://0047-sync-gcc-stddef.h-with-musl.patch \
+           file://0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch \
            ${BACKPORTS} \
 "
 BACKPORTS = "\
meta/recipes-devtools/gcc/gcc-7.1/0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch new file +160 -0

160 lines not on this page · raw message

Signature · 1 line
2.13.1
#12 lore raw

Re: [PATCH 07/10] gcc-sanitizer: Fix build with glibc 2.26

Quoted 5 lines · Khem Raj

sigaltstack is no more exposed by glibc see (bug 21517) therefore adjust to use stack_t instead

Use res_state typedef instead of referring to __res_state struct

Doesn't work against master:

| In file included from ../../../../../../../../../work-shared/gcc-7.1.0-r0/gcc-7.1.0/libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:23:0:
| ../../../../../../../../../work-shared/gcc-7.1.0-r0/gcc-7.1.0/libsanitizer/sanitizer_common/sanitizer_linux.h:24:8:
error: using typedef-name 'stack_t' after 'struct'

|  struct stack_t;
|         ^~~~~~~
| In file included from

/data/poky-tmp/master/work/corei7-64-poky-linux/gcc-sanitizers/7.1.0-r0/recipe-sysroot/usr/include/signal.h:322:0,
| from
../../../../../../../../../work-shared/gcc-7.1.0-r0/gcc-7.1.0/libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:17:
| /data/poky-tmp/master/work/corei7-64-poky-linux/gcc-sanitizers/7.1.0-r0/recipe-sysroot/usr/include/bits/sigstack.h:42:5:
note: 'stack_t' has a previous declaration here
| } stack_t;
| ^~~~~~~

Ross

author
#13 lore raw

Re: [PATCH 07/10] gcc-sanitizer: Fix build with glibc 2.26

Quoted 11 lines · Ross
Quoted 5 lines · Khem Raj

sigaltstack is no more exposed by glibc see (bug 21517) therefore adjust to use stack_t instead

Use res_state typedef instead of referring to __res_state struct

Doesn't work against master:

this patch is not needed until glibc 2.26 so drop it

Quoted 20 lines

| In file included from ../../../../../../../../../work-shared/gcc-7.1.0-r0/gcc-7.1.0/libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:23:0:
| ../../../../../../../../../work-shared/gcc-7.1.0-r0/gcc-7.1.0/libsanitizer/sanitizer_common/sanitizer_linux.h:24:8:
error: using typedef-name 'stack_t' after 'struct'

|  struct stack_t;
|         ^~~~~~~
| In file included from

/data/poky-tmp/master/work/corei7-64-poky-linux/gcc-sanitizers/7.1.0-r0/recipe-sysroot/usr/include/signal.h:322:0,
| from
../../../../../../../../../work-shared/gcc-7.1.0-r0/gcc-7.1.0/libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:17:
| /data/poky-tmp/master/work/corei7-64-poky-linux/gcc-sanitizers/7.1.0-r0/recipe-sysroot/usr/include/bits/sigstack.h:42:5:
note: 'stack_t' has a previous declaration here
| } stack_t;
| ^~~~~~~

Ross

author
#14 lore raw

PATCH 8/10 gcc7: Enable static PIE

In reply to Khem Raj
Signed-off-by Khem Raj <[email protected]>
---
 meta/recipes-devtools/gcc/gcc-7.1.inc              |  1 +
 .../gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch   | 37 ++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 meta/recipes-devtools/gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch
meta/recipes-devtools/gcc/gcc-7.1.inc +1 -0
index 77d5ac11eb..9d60620ac2 100644
@@ -79,6 +79,7 @@ SRC_URI = "\
            file://0046-libgcc_s-Use-alias-for-__cpu_indicator_init-instead-.patch \
            file://0047-sync-gcc-stddef.h-with-musl.patch \
            file://0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch \
+           file://0049-gcc-Enable-static-PIE.patch \
            ${BACKPORTS} \
 "
 BACKPORTS = "\
meta/recipes-devtools/gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch new file +37 -0
new file mode 100644
index 0000000000..879e360cf3
@@ -0,0 +1,37 @@
+From 44ef80688b56beea85c0070840dea1e2a4e34aed Mon Sep 17 00:00:00 2001
+From: Khem Raj <[email protected]>
+Date: Tue, 13 Jun 2017 12:12:52 -0700
+Subject: [PATCH 49/49] gcc: Enable static PIE
+
+Static PIE support in GCC
+see
+https://gcc.gnu.org/ml/gcc/2015-06/msg00008.html
+
+Upstream-Status: Pending
+
+Signed-off-by: Khem Raj <[email protected]>
+---
+ gcc/config/gnu-user.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/gcc/config/gnu-user.h b/gcc/config/gnu-user.h
+index 2787a3d16be..ee7b781319e 100644
+--- a/gcc/config/gnu-user.h
++++ b/gcc/config/gnu-user.h
+@@ -51,10 +51,10 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ #if defined HAVE_LD_PIE
+ #define GNU_USER_TARGET_STARTFILE_SPEC \
+   "%{!shared: %{pg|p|profile:gcrt1.o%s;: \
+-    %{" PIE_SPEC ":Scrt1.o%s} %{" NO_PIE_SPEC ":crt1.o%s}}} \
+-   crti.o%s %{static:crtbeginT.o%s;: %{shared:crtbeginS.o%s} \
++    %{" PIE_SPEC ":%{static:rcrt1.o%s;:Scrt1.o%s}} %{" NO_PIE_SPEC ":crt1.o%s}}} \
++   crti.o%s %{shared:crtbeginS.o%s;: \
+ 	      %{" PIE_SPEC ":crtbeginS.o%s} \
+-	      %{" NO_PIE_SPEC ":crtbegin.o%s}} \
++	      %{" NO_PIE_SPEC ":%{static:crtbeginT.o%s;:crtbegin.o%s}}} \
+    %{fvtable-verify=none:%s; \
+      fvtable-verify=preinit:vtv_start_preinit.o%s; \
+      fvtable-verify=std:vtv_start.o%s} \
+-- 
+2.13.1
+
Signature · 1 line
2.13.1
author
#15 lore raw

PATCH 9/10 libunwind: We set -fPIE in security flags now if gcc is not configured for default PIE

In reply to Khem Raj
Signed-off-by Khem Raj <[email protected]>
---
 meta/recipes-support/libunwind/libunwind_1.2.bb | 4 ----
 1 file changed, 4 deletions(-)
meta/recipes-support/libunwind/libunwind_1.2.bb +0 -4
index e598e40c6f..c6312f24fd 100644
@@ -21,8 +21,4 @@ EXTRA_OECONF_append_libc-musl = " --disable-documentation --disable-tests "
 ARM_INSTRUCTION_SET_armv4 = "arm"
 ARM_INSTRUCTION_SET_armv5 = "arm"
 
-# see https://sourceware.org/bugzilla/show_bug.cgi?id=19987
-SECURITY_CFLAGS_remove_aarch64 = "-fpie"
-SECURITY_CFLAGS_append_aarch64 = " -fPIE"
-
 LDFLAGS += "-Wl,-z,relro,-z,now ${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-gold', ' -fuse-ld=bfd ', '', d)}"
Signature · 1 line
2.13.1
author
#16 lore raw

PATCH 10/10 valgrind: Remove -no-pie from cflags

In reply to Khem Raj

It has been moved to distro security include file

Signed-off-by Khem Raj <[email protected]>
---
 meta/recipes-devtools/valgrind/valgrind_3.12.0.bb | 1 -
 1 file changed, 1 deletion(-)
meta/recipes-devtools/valgrind/valgrind_3.12.0.bb +0 -1
index d7b6d77000..65e9563291 100644
@@ -74,7 +74,6 @@ CACHED_CONFIGUREVARS += "ac_cv_path_PERL='/usr/bin/env perl'"
 SELECTED_OPTIMIZATION = "${DEBUG_FLAGS}"
 
 CFLAGS_append_libc-uclibc = " -D__UCLIBC__ "
-CFLAGS += "-no-pie"
 
 def get_mcpu(d):
     for arg in (d.getVar('TUNE_CCARGS') or '').split():
Signature · 1 line
2.13.1