mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-03 02:02:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

security_flags: use -fstack-protector-strong

Browse Source 
This is a better version of -fstack-protector-all with reduced stack usage and
better performance yet giving same amount of coverage.  It's available in gcc
4.9 onwards.

https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/ has more
details.

(From OE-Core rev: 4ca946c029f04ba3991ed0f1f65355a7a7840ff4)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Khem Raj
2016-02-05 16:52:41 +00:00
committed by Richard Purdie
parent a07f2fddbc
commit 61a58752f4
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
meta/conf/distro/include/security_flags.inc
View File

@@ -9,14 +9,14 @@
# -O0 which then results in a compiler warning.
lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}"
SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}"
SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}"
SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify}"
SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify}"
SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now"
SECURITY_X_LDFLAGS ?= "-Wl,-z,relro"
SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now"
SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro"
# powerpc does not get on with pie for reasons not looked into as yet
SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}"
SECURITY_CFLAGS_powerpc = "-fstack-protector-strong ${lcl_maybe_fortify}"
# Deal with ppc specific linker failures when using the cflags
SECURITY_CFLAGS_pn-dbus_powerpc = ""
SECURITY_CFLAGS_pn-dbus-ptest_powerpc = ""