Skip to content

Add GCCPIE knob to configure gcc with --enable-default-pie

Khem Raj openembedded-core 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest10 patches 6 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/10gcc: Introduce a knob to configure gcc to default to PIEmeta/conf/distro/include/security_flags.inc meta/recipes-devtools/gcc/gcc-configure-common.inc+6 -10 replies
2/10security_flags.inc: Delete pinnings for SECURITY_NO_PIE_CFLAGSmeta/conf/distro/include/security_flags.inc+22 -610 replies
3/10distutils, setuptools: Delete use of SECURITY_NO_PIE_CFLAGSmeta/classes/distutils-common-base.bbclass meta/classes/setuptools.bbclass+0 -40 replies
4/10ffmpeg: Upgrade to 3.3.2 stablemeta/recipes-multimedia/ffmpeg/ffmpeg/0001-build-fix-for-mips.patch meta/recipes-multimedia/ffmpeg/ffmpeg_3.3.2.bb+47 -20 replies
5/10gobject-introspection: Disable generating static lbrariesmeta/recipes-gnome/gobject-introspection/gobject-introspection_1.50.0.bb+1 -04 replies
6/10zlib: Pass pre-calculate uname enable re-entrant flagsmeta/recipes-core/zlib/zlib_1.2.11.bb+7 -50 replies
7/10gcc-sanitizer: Fix build with glibc 2.26meta/recipes-devtools/gcc/gcc-7.1.inc meta/recipes-devtools/gcc/gcc-7.1/0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch+161 -02 replies
8/10gcc7: Enable static PIEmeta/recipes-devtools/gcc/gcc-7.1.inc meta/recipes-devtools/gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch+38 -00 replies
9/10libunwind: We set -fPIE in security flags now if gcc is not configured for default PIEmeta/recipes-support/libunwind/libunwind_1.2.bb+0 -40 replies
10/10valgrind: Remove -no-pie from cflagsmeta/recipes-devtools/valgrind/valgrind_3.12.0.bb+0 -10 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 00/10] Add GCCPIE knob to configure gcc with --enable-default-pie

* This patchset add a switch to configure gcc driver with PIE defaults
* Add support for generating static PIE in gcc
* Gets rid of lot of bandaids from distro security flags file
* Adjust recipes for new way of specifying pie
* Upgrade and Fix mips build for ffmpeg along the way

The following changes since commit 059846662f1ea1c82804cfce5f91afcb2980ec8a:

mtools-native: fix Upstream-Status (2017-06-14 14:45:01 +0100)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib kraj/hardening-fixes
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=kraj/hardening-fixes

Khem Raj (10):
gcc: Introduce a knob to configure gcc to default to PIE security_flags.inc: Delete pinnings for SECURITY_NO_PIE_CFLAGS distutils,setuptools: Delete use of SECURITY_NO_PIE_CFLAGS
ffmpeg: Upgrade to 3.3.2 stable
gobject-introspection: Disable generating static lbraries
zlib: Pass pre-calculate uname enable re-entrant flags
gcc-sanitizer: Fix build with glibc 2.26
gcc7: Enable static PIE
libunwind: We set -fPIE in security flags now if gcc is not configured
for default PIE
valgrind: Remove -no-pie from cflags

 meta/classes/distutils-common-base.bbclass         |   2 -
 meta/classes/setuptools.bbclass                    |   2 -
 meta/conf/distro/include/security_flags.inc        |  85 ++++-------
 meta/recipes-core/zlib/zlib_1.2.11.bb              |  12 +-
 meta/recipes-devtools/gcc/gcc-7.1.inc              |   2 +
 ...r-Use-stack_t-instead-of-struct-sigaltsta.patch | 160 +++++++++++++++++++++
 .../gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch   |  37 +++++
 meta/recipes-devtools/gcc/gcc-configure-common.inc |   3 +
 meta/recipes-devtools/valgrind/valgrind_3.12.0.bb  |   1 -
 .../gobject-introspection_1.50.0.bb                |   1 +
 .../ffmpeg/ffmpeg/0001-build-fix-for-mips.patch    |  44 ++++++
 .../ffmpeg/{ffmpeg_3.3.bb => ffmpeg_3.3.2.bb}      |   5 +-
 meta/recipes-support/libunwind/libunwind_1.2.bb    |   4 -
 13 files changed, 281 insertions(+), 77 deletions(-)
 create mode 100644 meta/recipes-devtools/gcc/gcc-7.1/0048-libsanitizer-Use-stack_t-instead-of-struct-sigaltsta.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-7.1/0049-gcc-Enable-static-PIE.patch
 create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/0001-build-fix-for-mips.patch
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_3.3.bb => ffmpeg_3.3.2.bb} (97%)
Signature · 1 line
2.13.1