security_flags: Add the compiler and linker flags that enhance security
PATCH v3 1/1 security_flags: Add the compiler and linker flags that enhance security
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
[YOCTO #3868]
--- meta/conf/distro/include/security_flags.inc | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 meta/conf/distro/include/security_flags.inc
meta/conf/distro/include/security_flags.inc new file +26 -0
@@ -0,0 +1,26 @@ +SECURITY_CFLAGS = "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" +SECURITY_LDFLAGS = "-Wl,-z,relro,-z,now" + +# Curl seems to check for FORTIFY_SOURCE in CFLAGS, but even assigned +# to CPPFLAGS it gets picked into CFLAGS in bitbake. +#TARGET_CPPFLAGS_pn-curl += "-D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-curl = "-fstack-protector-all -pie -fpie" +SECURITY_CFLAGS_pn-ppp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-eglibc = "" +SECURITY_CFLAGS_pn-eglibc-initial = "" +SECURITY_CFLAGS_pn-zlib = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-gcc-runtime = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libgcc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-tcl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libcap = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-smartpm = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-imaging = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-pycurl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-kexec-tools = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +# These 2 have text relco errors with the pie options enabled +SECURITY_CFLAGS_pn-pulseaudio = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-ltp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +TARGET_CFLAGS_append = " ${SECURITY_CFLAGS}" +TARGET_LDFLAGS_append = " ${SECURITY_LDFLAGS}"
Signature · 1 line
1.8.1.4
Quoted 23 lines · Saul Wold
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
[YOCTO #3868]
Signed-off-by Saul Wold <[email protected]>---
meta/conf/distro/include/security_flags.inc | 26 ++++++++++++++++++++++++++1 file changed, 26 insertions(+)create mode 100644 meta/conf/distro/include/security_flags.inc
meta/conf/distro/include/security_flags.inc new file +0
-0
meta/conf/distro/include/security_flags.inc line 2
Quoted 2 lines
meta/conf/distro/include/security_flags.inc new file +2
-0@@ -0,0 +1,26 @@ +SECURITY_CFLAGS = "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" +SECURITY_LDFLAGS = "-Wl,-z,relro,-z,now"
these should be weak assignments (?=) I think
Quoted 31 lines
meta/conf/distro/include/security_flags.inc new file +24
-0+ +# Curl seems to check for FORTIFY_SOURCE in CFLAGS, but even assigned +# to CPPFLAGS it gets picked into CFLAGS in bitbake. +#TARGET_CPPFLAGS_pn-curl += "-D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-curl = "-fstack-protector-all -pie -fpie" +SECURITY_CFLAGS_pn-ppp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-eglibc = "" +SECURITY_CFLAGS_pn-eglibc-initial = "" +SECURITY_CFLAGS_pn-zlib = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-gcc-runtime = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libgcc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-tcl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-libcap = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-smartpm = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-imaging = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-python-pycurl = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-kexec-tools = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +# These 2 have text relco errors with the pie options enabled +SECURITY_CFLAGS_pn-pulseaudio = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_pn-ltp = "-fstack-protector-all -D_FORTIFY_SOURCE=2" + +TARGET_CFLAGS_append = " ${SECURITY_CFLAGS}" +TARGET_LDFLAGS_append = " ${SECURITY_LDFLAGS}"Signature · 6 lines
1.8.1.4 _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 8 lines · Saul Wold
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
Will we be enabling this in Poky?
Ross
Quoted 5 lines · Ross
Quoted 4 lines · Saul Wold
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later.
Quoted 7 lines
Quoted 4 lines
This needs to be explicitly enabled by adding the following line to your local.conf:
require conf/distro/include/security_flags.inc
Will we be enabling this in Poky?
No we will not enable by default, but we will do builds with them enabled regularly to test for build failures. They add overhead both in binary size and performance.
Sau!
Quoted 3 lines
Ross