Fix issues when using security_flags on musl

PATCH In review Khem Raj 2 participants 8 messages Feb 4, 2016

Share & tools

Khem Raj

author

2016-02-04 22:54 UTC #0 lore raw

v2 cover Fix issues when using security_flags on musl

security_flags enabled builds revealed several issues when building on musl especially compiling gcc runtime libs we should not use fstack-protector another change is to replace with -fstack-protector-all with -fstack-protector-strong which is available since 4.9 and has best of both worlds (stack size usage and security) gcc on musl/ppc was missing patches as a result images werent booting on qemuppc that is fixed too. It also revealed some more issues in compiling gcc for musl systems was not getting all configs right.
Addressed the review comments on nss-myhostname

Changes since v1:
Ignore security flags for non target packages

The following changes since commit 1b2e1eb6f08b6f95cf555d7f6bc6e4de2113aaed:

libical: Work around hardcoded paths in pkgconfig file (2016-02-04 13:09:51 +0000)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib kraj/pu
http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=kraj/pu

Khem Raj (6):
nss-myhostname: Fix build on musl
gcc: Fix build on musl with -fstack-protector
security_flags: Disable fstack-protector for gcc runtime libs
security_flags: Replace -fstack-protector-all with
-fstack-protector-strong
gcc: Assume libssp and dl_iterate_phdr on musl
gcc: musl related fixes for unwinding,ppc/secure-plt and gthr

 meta/conf/distro/include/security_flags.inc        | 23 ++++---
 meta/recipes-devtools/gcc/gcc-5.3.inc              |  7 +-
 .../gcc/gcc-5.3/0047-Fix-nios2-musl-build.patch    | 11 ---
 .../0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch    | 28 ++++++++
 .../gcc/gcc-5.3/0048-ssp_nonshared.patch           | 29 ++++++++
 ...-weak-reference-logic-in-gthr.h-for-os-ge.patch | 78 ++++++++++++++++++++++
 ...050-powerpc-pass-secure-plt-to-the-linker.patch | 66 ++++++++++++++++++
 .../gcc-5.3/0051-support-unwinding-on-musl.patch   | 34 ++++++++++
 ...tname-Check-for-nss.h-presense-before-use.patch | 53 +++++++++++++++
 .../nss-myhostname/nss-myhostname_0.3.bb           |  4 +-
 10 files changed, 311 insertions(+), 22 deletions(-)
 delete mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0047-Fix-nios2-musl-build.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0048-ssp_nonshared.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0049-Disable-the-weak-reference-logic-in-gthr.h-for-os-ge.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0050-powerpc-pass-secure-plt-to-the-linker.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0051-support-unwinding-on-musl.patch
 create mode 100644 meta/recipes-support/nss-myhostname/nss-myhostname/0001-nss-myhostname-Check-for-nss.h-presense-before-use.patch

Signature · 1 line

2.7.0

Khem Raj

author

2016-02-04 22:55 UTC #1 lore raw

PATCH v2 1/6 nss-myhostname: Fix build on musl

provide needed data types if nss.h is not available

Signed-off-by Khem Raj <[email protected]>

---
 ...tname-Check-for-nss.h-presense-before-use.patch | 53 ++++++++++++++++++++++
 .../nss-myhostname/nss-myhostname_0.3.bb           |  4 +-
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-support/nss-myhostname/nss-myhostname/0001-nss-myhostname-Check-for-nss.h-presense-before-use.patch

meta/recipes-support/nss-myhostname/nss-myhostname/0001-nss-myhostname-Check-for-nss.h-presense-before-use.patch new file +53 -0

new file mode 100644
index 0000000..82f2574
@@ -0,0 +1,53 @@
+From d1345871b992f9a055c968963967e728da1a7ffb Mon Sep 17 00:00:00 2001
+From: Khem Raj <[email protected]>
+Date: Sat, 30 Jan 2016 20:29:06 +0000
+Subject: [PATCH] nss-myhostname: Check for nss.h presense before use
+
+We do not have nss.h on musl e.g. and configury is already checking for
+nss.h presence, use this to define needed data structures if nss.h is
+missing on a given libc implementation on a platform
+
+include stdint.h for uint32_h definition
+
+Signed-off-by: Khem Raj <[email protected]>
+---
+Upstream-Status: Pending
+
+ nss-myhostname.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/nss-myhostname.c b/nss-myhostname.c
+index 293166c..6f287f5 100644
+--- a/nss-myhostname.c
++++ b/nss-myhostname.c
+@@ -21,7 +21,27 @@
+ ***/
+ 
+ #include <limits.h>
++#include <stdint.h>
++#ifdef HAVE_NSS_H
+ #include <nss.h>
++#else
++enum nss_status {
++    NSS_STATUS_TRYAGAIN = -2,
++    NSS_STATUS_UNAVAIL,
++    NSS_STATUS_NOTFOUND,
++    NSS_STATUS_SUCCESS,
++    NSS_STATUS_RETURN
++};
++/* Data structure used for the 'gethostbyname4_r' function.  */
++struct gaih_addrtuple
++  {
++    struct gaih_addrtuple *next;
++    char *name;
++    int family;
++    uint32_t addr[4];
++    uint32_t scopeid;
++  };
++#endif
+ #include <sys/types.h>
+ #include <netdb.h>
+ #include <errno.h>
+-- 
+2.7.0
+

meta/recipes-support/nss-myhostname/nss-myhostname_0.3.bb +3 -1

index bbce9e9..de5b7cf 100644
@@ -6,7 +6,9 @@ HOMEPAGE = "http://0pointer.de/lennart/projects/nss-myhostname/"
 LICENSE = "LGPLv2.1"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1"
 
-SRC_URI = "http://0pointer.de/lennart/projects/nss-myhostname/nss-myhostname-${PV}.tar.gz"
+SRC_URI = "http://0pointer.de/lennart/projects/nss-myhostname/nss-myhostname-${PV}.tar.gz \
+           file://0001-nss-myhostname-Check-for-nss.h-presense-before-use.patch \
+           "
 
 SRC_URI[md5sum] = "d4ab9ac36c053ab8fb836db1cbd4a48f"
 SRC_URI[sha256sum] = "2ba744ea8d578d1c57c85884e94a3042ee17843a5294434d3a7f6c4d67e7caf2"

Signature · 1 line

2.7.0

Khem Raj

author

2016-02-04 22:55 UTC #2 lore raw

PATCH v2 2/6 gcc: Fix build on musl with -fstack-protector

When enabling the secutity flags on musl based targets the builds fail due to libssp(gcc-runtime) build asking to link with libssp and libssp_nonshared.a when configuring libssp itself. This does not work with musl since it does provide ssp implementation but not like glibc where these libraries are separate to libc

Fix the nios2 patch with upstream status while at it and generate the patch after applying to my tree

Signed-off-by Khem Raj <[email protected]>

---
 meta/recipes-devtools/gcc/gcc-5.3.inc              |  3 ++-
 .../gcc/gcc-5.3/0047-Fix-nios2-musl-build.patch    | 11 --------
 .../0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch    | 28 +++++++++++++++++++++
 .../gcc/gcc-5.3/0048-ssp_nonshared.patch           | 29 ++++++++++++++++++++++
 4 files changed, 59 insertions(+), 12 deletions(-)
 delete mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0047-Fix-nios2-musl-build.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0048-ssp_nonshared.patch

meta/recipes-devtools/gcc/gcc-5.3.inc +2 -1

index 80999c1..e12bfad 100644
@@ -76,7 +76,8 @@ SRC_URI = "\
            file://0044-Adding-mmusl-as-a-musl-libc-specifier-and-the-necess.patch \
            file://0045-Support-for-arm-linux-musl.patch \
            file://0046-Get-rid-of-ever-broken-fixincludes-on-musl.patch \
-	   file://0047-Fix-nios2-musl-build.patch \
+           file://0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch \
+           file://0048-ssp_nonshared.patch \
           "
 
 BACKPORTS = ""

meta/recipes-devtools/gcc/gcc-5.3/0047-Fix-nios2-musl-build.patch deleted +0 ~~-11~~

deleted file mode 100644
index 44cea84..0000000
@@ -1,11 +0,0 @@
-diff -Naru gcc-5.3.0.orig/gcc/config/nios2/linux.h gcc-5.3.0/gcc/config/nios2/linux.h
---- gcc-5.3.0.orig/gcc/config/nios2/linux.h	2015-05-28 16:08:37.000000000 +0200
-+++ gcc-5.3.0/gcc/config/nios2/linux.h	2016-01-04 02:42:46.878844806 +0100
-@@ -30,6 +30,7 @@
- #define CPP_SPEC "%{posix:-D_POSIX_SOURCE} %{pthread:-D_REENTRANT}"
- 
- #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux-nios2.so.1"
-+#define MUSL_DYNAMIC_LINKER  "/lib/ld-musl-nios2.so.1"
- 
- #undef LINK_SPEC
- #define LINK_SPEC LINK_SPEC_ENDIAN \

meta/recipes-devtools/gcc/gcc-5.3/0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch new file +28 -0

new file mode 100644
index 0000000..a1cfb9c
@@ -0,0 +1,28 @@
+From f5ca07132b9292d2045ca7204e9cbfde2e59d0bf Mon Sep 17 00:00:00 2001
+From: Khem Raj <[email protected]>
+Date: Tue, 2 Feb 2016 10:26:10 -0800
+Subject: [PATCH 47/48] nios2: Define MUSL_DYNAMIC_LINKER
+
+Signed-off-by: Marek Vasut <[email protected]>
+Signed-off-by: Khem Raj <[email protected]>
+---
+Upstream-Status: Pending
+
+ gcc/config/nios2/linux.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/gcc/config/nios2/linux.h b/gcc/config/nios2/linux.h
+index f43f655..5587ab3 100644
+--- a/gcc/config/nios2/linux.h
++++ b/gcc/config/nios2/linux.h
+@@ -30,6 +30,7 @@
+ #define CPP_SPEC "%{posix:-D_POSIX_SOURCE} %{pthread:-D_REENTRANT}"
+ 
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux-nios2.so.1"
++#define MUSL_DYNAMIC_LINKER  "/lib/ld-musl-nios2.so.1"
+ 
+ #undef LINK_SPEC
+ #define LINK_SPEC LINK_SPEC_ENDIAN \
+-- 
+2.7.0
+

meta/recipes-devtools/gcc/gcc-5.3/0048-ssp_nonshared.patch new file +29 -0

new file mode 100644
index 0000000..5ddd40a
@@ -0,0 +1,29 @@
+From 3cb6013cf287ed9b1247ea37541e64b9810a121d Mon Sep 17 00:00:00 2001
+From: Szabolcs Nagy <[email protected]>
+Date: Sat, 7 Nov 2015 14:58:40 +0000
+Subject: [PATCH 48/48] ssp_nonshared
+
+---
+Signed-off-by: Khem Raj <[email protected]>
+Upstream-Status: Pending
+
+ gcc/gcc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/gcc/gcc.c b/gcc/gcc.c
+index 8f53aea..3ddc658 100644
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -732,7 +732,8 @@ proper position among the other output files.  */
+ #ifndef LINK_SSP_SPEC
+ #ifdef TARGET_LIBC_PROVIDES_SSP
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+-		       "|fstack-protector-strong|fstack-protector-explicit:}"
++		       "|fstack-protector-strong|fstack-protector-explicit" \
++		       ":-lssp_nonshared}"
+ #else
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ 		       "|fstack-protector-strong|fstack-protector-explicit" \
+-- 
+2.7.0
+

Signature · 1 line

2.7.0

Khem Raj

author

2016-02-04 22:55 UTC #3 lore raw

PATCH v2 3/6 security_flags: Disable fstack-protector for gcc runtime libs

In reply to Khem Raj

it causes a catch-22 situation where we build libssp in gcc-runtime but also pass -fstack-protector flags which require libssp, these libraries are special as well.

also flush out ldflags for gcc libs and glibc

Signed-off-by Khem Raj <[email protected]>

---
 meta/conf/distro/include/security_flags.inc | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

meta/conf/distro/include/security_flags.inc +8 -3

index ac4fc65..7f898ee 100644
@@ -39,8 +39,8 @@ SECURITY_CFLAGS_pn-expect = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-flac = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-flex = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gcc = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gcc-runtime = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gcc-sanitizers = "${SECURITY_NO_PIE_CFLAGS}"
+SECURITY_CFLAGS_pn-gcc-runtime = ""
+SECURITY_CFLAGS_pn-gcc-sanitizers = ""
 SECURITY_CFLAGS_pn-gdb = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gmp = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gnutls = "${SECURITY_NO_PIE_CFLAGS}"

@@ -59,7 +59,7 @@ SECURITY_CFLAGS_pn-kexec-tools = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-iptables = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libaio = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libcap = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libgcc = "${SECURITY_NO_PIE_CFLAGS}"
+SECURITY_CFLAGS_pn-libgcc = ""
 SECURITY_CFLAGS_pn-libid3tag = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libnewt = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libglu = "${SECURITY_NO_PIE_CFLAGS}"

@@ -90,6 +90,11 @@ SECURITY_CFLAGS_pn-pulseaudio = "${SECURITY_NO_PIE_CFLAGS}"
 TARGET_CFLAGS_append = " ${SECURITY_CFLAGS}"
 TARGET_LDFLAGS_append = " ${SECURITY_LDFLAGS}"
 
+SECURITY_LDFLAGS_pn-gcc-runtime = ""
+SECURITY_LDFLAGS_pn-gcc-sanitizers = ""
+SECURITY_LDFLAGS_pn-glibc = ""
+SECURITY_LDFLAGS_pn-glibc-initial = ""
+SECURITY_LDFLAGS_pn-libgcc = ""
 SECURITY_LDFLAGS_pn-xf86-video-fbdev = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-intel = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-omapfb = "${SECURITY_X_LDFLAGS}"

Signature · 1 line

2.7.0

Andre McCurdy

2016-02-04 23:07 UTC #4 lore raw

Re: [PATCH 3/6] security_flags: Disable fstack-protector for gcc runtime libs

Quoted 27 lines · Khem Raj

it causes a catch-22 situation where we build libssp in gcc-runtime but also pass -fstack-protector flags which require libssp, these libraries are special as well.

also flush out ldflags for gcc libs and glibc

Signed-off-by Khem Raj <[email protected]>

---
 meta/conf/distro/include/security_flags.inc | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

meta/conf/distro/include/security_flags.inc +2 -2

index ac4fc65..7f898ee 100644
@@ -39,8 +39,8 @@ SECURITY_CFLAGS_pn-expect = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-flac = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-flex = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gcc = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gcc-runtime = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-gcc-sanitizers = "${SECURITY_NO_PIE_CFLAGS}"
+SECURITY_CFLAGS_pn-gcc-runtime = ""
+SECURITY_CFLAGS_pn-gcc-sanitizers = ""
 SECURITY_CFLAGS_pn-gdb = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gmp = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-gnutls = "${SECURITY_NO_PIE_CFLAGS}"

meta/conf/distro/include/security_flags.inc SECURITY_CFLAGS_pn-kexec-tools = "${SECURITY_NO_PIE_CFLAGS}" · line 62

Quoted 5 lines

meta/conf/distro/include/security_flags.inc +1 -1

@@ -59,7 +59,7 @@ SECURITY_CFLAGS_pn-kexec-tools = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-iptables = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libaio = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libcap = "${SECURITY_NO_PIE_CFLAGS}"
-SECURITY_CFLAGS_pn-libgcc = "${SECURITY_NO_PIE_CFLAGS}"
+SECURITY_CFLAGS_pn-libgcc = ""

Should libgcc-initial be included here too?

Quoted 23 lines

meta/conf/distro/include/security_flags.inc +5 -1

 SECURITY_CFLAGS_pn-libid3tag = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libnewt = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-libglu = "${SECURITY_NO_PIE_CFLAGS}"

@@ -90,6 +90,11 @@ SECURITY_CFLAGS_pn-pulseaudio = "${SECURITY_NO_PIE_CFLAGS}"
 TARGET_CFLAGS_append = " ${SECURITY_CFLAGS}"
 TARGET_LDFLAGS_append = " ${SECURITY_LDFLAGS}"
 
+SECURITY_LDFLAGS_pn-gcc-runtime = ""
+SECURITY_LDFLAGS_pn-gcc-sanitizers = ""
+SECURITY_LDFLAGS_pn-glibc = ""
+SECURITY_LDFLAGS_pn-glibc-initial = ""
+SECURITY_LDFLAGS_pn-libgcc = ""
 SECURITY_LDFLAGS_pn-xf86-video-fbdev = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-intel = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-omapfb = "${SECURITY_X_LDFLAGS}"
--

2.7.0

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Khem Raj

author

2016-02-04 22:55 UTC #5 lore raw

PATCH v2 4/6 security_flags: Replace -fstack-protector-all with -fstack-protector-strong

In reply to Khem Raj

since gcc 4.9 this is new option added to gcc which is a better version of fstack-protector-all with reduced stack usage and better performance yet giving same amount of coverage.

pass fstack-protector-strong to linker flags as well so ld is passed flags to link with ssp libraries

https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/

describes it in usablility terms.

Do not use ssp when compiling glibc and gcc libs

ensure that security flags are only used for target packages

Signed-off-by Khem Raj <[email protected]>

---
 meta/conf/distro/include/security_flags.inc | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

meta/conf/distro/include/security_flags.inc +11 ~~-11~~

index 7f898ee..ff5d940 100644
@@ -9,11 +9,11 @@
 # -O0 which then results in a compiler warning.
 lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}"
 
-SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}"
-SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}"
+SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify}"
+SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify}"
 
-SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now"
-SECURITY_X_LDFLAGS ?= "-Wl,-z,relro"
+SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now"
+SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro"
 
 # powerpc does not get on with pie for reasons not looked into as yet
 SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}"

@@ -87,14 +87,14 @@ SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-ltp = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-pulseaudio = "${SECURITY_NO_PIE_CFLAGS}"
 
-TARGET_CFLAGS_append = " ${SECURITY_CFLAGS}"
-TARGET_LDFLAGS_append = " ${SECURITY_LDFLAGS}"
+TARGET_CFLAGS_append_class-target = " ${SECURITY_CFLAGS}"
+TARGET_LDFLAGS_append_class-target = " ${SECURITY_LDFLAGS}"
 
-SECURITY_LDFLAGS_pn-gcc-runtime = ""
-SECURITY_LDFLAGS_pn-gcc-sanitizers = ""
-SECURITY_LDFLAGS_pn-glibc = ""
-SECURITY_LDFLAGS_pn-glibc-initial = ""
-SECURITY_LDFLAGS_pn-libgcc = ""
+SECURITY_LDFLAGS_remove_pn-gcc-runtime = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-gcc-sanitizers = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-glibc = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-glibc-initial = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-libgcc = "-fstack-protector-strong"
 SECURITY_LDFLAGS_pn-xf86-video-fbdev = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-intel = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-omapfb = "${SECURITY_X_LDFLAGS}"

Signature · 1 line

2.7.0

Khem Raj

author

2016-02-04 22:55 UTC #6 lore raw

PATCH v2 5/6 gcc: Assume libssp and dl_iterate_phdr on musl

In reply to Khem Raj

gcc configure fails to set these settings correctly on musl based builds

Signed-off-by Khem Raj <[email protected]>

---
 meta/recipes-devtools/gcc/gcc-5.3.inc | 1 +
 1 file changed, 1 insertion(+)

meta/recipes-devtools/gcc/gcc-5.3.inc +1 -0

index e12bfad..83e061f 100644
@@ -123,6 +123,7 @@ EXTRA_OECONF_INITIAL = "\
 "
 
 EXTRA_OECONF_append_libc-uclibc = " --disable-decimal-float "
+EXTRA_OECONF_append_libc-musl = " gcc_cv_libc_provides_ssp=yes gcc_cv_target_dl_iterate_phdr=yes "
 
 EXTRA_OECONF_PATHS = "\
     --with-gxx-include-dir=/not/exist{target_includedir}/c++/${BINV} \

Signature · 1 line

2.7.0

Khem Raj

author

2016-02-04 22:55 UTC #7 lore raw

PATCH v2 6/6 gcc: musl related fixes for unwinding, ppc/secure-plt and gthr

In reply to Khem Raj

These issues are fixing building gcc for target, ppc issue helps in fixing discrepency between gcc cmdline and linker cmdline

Signed-off-by Khem Raj <[email protected]>

---
 meta/recipes-devtools/gcc/gcc-5.3.inc              |  3 +
 ...-weak-reference-logic-in-gthr.h-for-os-ge.patch | 78 ++++++++++++++++++++++
 ...050-powerpc-pass-secure-plt-to-the-linker.patch | 66 ++++++++++++++++++
 .../gcc-5.3/0051-support-unwinding-on-musl.patch   | 34 ++++++++++
 4 files changed, 181 insertions(+)
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0049-Disable-the-weak-reference-logic-in-gthr.h-for-os-ge.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0050-powerpc-pass-secure-plt-to-the-linker.patch
 create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/0051-support-unwinding-on-musl.patch

meta/recipes-devtools/gcc/gcc-5.3.inc +3 -0

index 83e061f..372b844 100644
@@ -78,6 +78,9 @@ SRC_URI = "\
            file://0046-Get-rid-of-ever-broken-fixincludes-on-musl.patch \
            file://0047-nios2-Define-MUSL_DYNAMIC_LINKER.patch \
            file://0048-ssp_nonshared.patch \
+           file://0049-Disable-the-weak-reference-logic-in-gthr.h-for-os-ge.patch \
+           file://0050-powerpc-pass-secure-plt-to-the-linker.patch \
+           file://0051-support-unwinding-on-musl.patch \
           "
 
 BACKPORTS = ""

meta/recipes-devtools/gcc/gcc-5.3/0049-Disable-the-weak-reference-logic-in-gthr.h-for-os-ge.patch new file +78 -0

78 lines not on this page · raw message

meta/recipes-devtools/gcc/gcc-5.3/0050-powerpc-pass-secure-plt-to-the-linker.patch new file +66 -0

66 lines not on this page · raw message

meta/recipes-devtools/gcc/gcc-5.3/0051-support-unwinding-on-musl.patch new file +34 -0

new file mode 100644
index 0000000..b0480b3
@@ -0,0 +1,34 @@
+From 2ed1e7da8b4367af28588131ff510a1d238131b2 Mon Sep 17 00:00:00 2001
+From: Szabolcs Nagy <[email protected]>
+Date: Sat, 1 Aug 2015 22:37:27 +0000
+Subject: [PATCH 51/51] support unwinding on musl
+
+musl does not define __GLIBC__ so we need
+to take care of that case
+
+Signed-off-by: Khem Raj <[email protected]>
+---
+Upstream-Status: Pending
+ libgcc/unwind-dw2-fde-dip.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libgcc/unwind-dw2-fde-dip.c b/libgcc/unwind-dw2-fde-dip.c
+index e1e566b..137dced 100644
+--- a/libgcc/unwind-dw2-fde-dip.c
++++ b/libgcc/unwind-dw2-fde-dip.c
+@@ -59,6 +59,12 @@
+ 
+ #if !defined(inhibit_libc) && defined(HAVE_LD_EH_FRAME_HDR) \
+     && defined(TARGET_DL_ITERATE_PHDR) \
++    && defined(__linux__)
++# define USE_PT_GNU_EH_FRAME
++#endif
++
++#if !defined(inhibit_libc) && defined(HAVE_LD_EH_FRAME_HDR) \
++    && defined(TARGET_DL_ITERATE_PHDR) \
+     && (defined(__DragonFly__) || defined(__FreeBSD__))
+ # define ElfW __ElfN
+ # define USE_PT_GNU_EH_FRAME
+-- 
+2.7.0
+

Signature · 1 line

2.7.0