The security flags were missing from the SDK toolchain
because they were added specifically to class-target.
Add them to class-cross-canadian as well (since the SDK environment
file is created from cross-canadian target flags).
(From OE-Core rev: d6df153991c91a1a14b561b3af52dcf96b73e6d7)
Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
Signed-off-by: Antoine Manache <a.manache@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ensure glibc-testsuite has the same flags as glibc.
(From OE-Core rev: f8ab08441f90eb75295304c57746c6e5f907ca64)
Signed-off-by: Nathan Rossi <nathan@nathanrossi.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are var-SECURITY_PIE_CFLAGS, var-lcl_maybe_fortify and
var-SECURITY_STRINGFORMAT which are helpful for OVERRIDES.
Also add var-SECURITY_STACK_PROTECTOR, and drop hardcoded `_remove'
overrides. Such as `4ca946c security_flags: use -fstack-protector-strong',
it s/-fstack-protector-all/-fstack-protector-strong/, only tweak
var-SECURITY_STACK_PROTECTOR is sufficient.
The fix does not have any side affect on SECURITY_CFLAGS of glibc/
glibc-initial/gcc-runtime, these three directly assigned with "".
...
SECURITY_CFLAGS_pn-glibc = ""
SECURITY_CFLAGS_pn-glibc-initial = ""
SECURITY_CFLAGS_pn-gcc-runtime = ""
...
(From OE-Core rev: 0ed4a6233bdcb25cbdce698504611541420d92d0)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Since poky enable security flags+pie by default, tweak comments
to sync with it.
[poky commit]
491082c poky.conf: Enable security flags+pie by default
29d76b3 poky-lsb: Remove including security_flags.inc
[poky commit]
- Use `?=' to set a default lcl_maybe_fortify, it is helpful for
variable OVERRIDES.
(From OE-Core rev: 38c410bb7d1688cd952da9f19269c2a65a92ab45)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Original approach to add -no-<pie> flags cause link time behavior changes
where packages start to lose the -fPIC -DPIC in compiler cmdline and this
list keeps growing as we build more and more packages,
Instead lets just remove the options we dont need from SECURITY_CFLAGS
this makes it more robust and less intrusive
This also means we do not need to re-add pic options as we started to do
for affected packages
(From OE-Core rev: 1520f5a345fd03d46f33f0efaf76191e96344bec)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes issues related out of range R_PPC_REL24
e.g.
/usr/lib/xorg/modules/input/libinput_drv.so: /usr/lib/libinput.so.10: R_PPC_REL24 relocation at 0x0e8602c4 for symbol `libevdev_has_event_code' out of range
(From OE-Core rev: 48c8d13a9bdcacb64a330074588f7c6bb5cae90d)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Static PIE doesn't work entirely right in GCC 7, for example ldconfig on ARM
with the flags enabled will something segfault during initialisation.
To mitigate this until we have GCC 8 integrated, don't enable static PIE.
(From OE-Core rev: 5f64946b8740a5d944f48ec430470265703bfe5e)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We need to ensure that all xorg modules are linked with
SECURITY_X_LDFLAGS to ensure that they will be able to resolve their run
time dependencies. The approach of listing each driver in
security_flags.inc lets less frequently used drivers be run-time
broken. Move the flag logic into xorg-driver-common.inc so that all
xorg modules from all layers will have the correct security flags used.
Cc: Khem Raj <raj.khem@gmail.com>
(From OE-Core rev: 27fce6ec277788f8fad0c9799e784df80f791120)
Signed-off-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These functions were moved to meta/lib/oe in 2010 and the base_* functions in
utils.bbclass were intended to be a short-term compatibility layer. They're
still used in a few places, so update the callers to use the new functions.
(From OE-Core rev: c97acbd034532895ce57c6717ed1b3ccc7900b0d)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since we have disabled FPIE from SECURITY_CFLAGS already, we have
to ensure the same with gcc, otherwise gcc (on-device) will be built
defaulting to PIE, and such binaries will fail to execute
(From OE-Core rev: 4f3a9ccdb1d45804f4c094589e69e0bc87dc9c62)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCC is configured correctly to pass PIE cflags/ldflags
(From OE-Core rev: e93765ffb5718b0fce84f0b8123963176dea95e4)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCCPIE flag which is empty by default adds "--enable-default-pie"
configure option for harderned distros
We do not require to add -fpie -pie flag externally anymore
(From OE-Core rev: 1c7e195c94764d680a12a49b870f04cd58860f81)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
uclibc support was removed a while ago and musl works much better. Start to
remove the various overrides and patches related to uclibc which are no longer
needed.
uclibc support in a layer would still be possible. I have strong reasons to
believe nobody is still using uclibc since patches are missing and I doubt
the metadata even parses anymore.
(From OE-Core rev: 653704e9cf325cb494eb23facca19e9f05132ffd)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The python-pycurl recipe can be used with python2 only even
though python3 is officially supported by upstream.
Create python3-pycurl recipe enabling the pycurl module for
python3.
(From OE-Core rev: 6cb9c0a4e75c647b38c81d2d7217b54b2fdfd972)
Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Also remove the override from security_flags.inc
(From OE-Core rev: 33d084a66a371fb10e26a0a23c639c69ddd3f1e5)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport build fix that removes -Wformat-security for specific tests.
Enable "-Wformat-security" for cmake in security_flags.inc.
(From OE-Core rev: b00f9c77ebd211578ba133c28abcbc5752305e25)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Otherwise this fails to build the libraries:
relocation R_X86_64_PC32 against undefined hidden symbol `__init_array_start'
can not be used when making a shared object
(From OE-Core rev: 632eee4fbd4627482aae752eb41104b3a848fd58)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As we've fixed the string formatting issue in console-tools, we don't
need to override SECURITY_STRINGFORMAT for console-tools any more.
[YOCTO #9540]
(From OE-Core rev: 3883332f84d9da0792c2c7337e842da34ea1b06c)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This creeped in along with rest of the changes in
c999b3d88dfcffbe0fb66406fb0bff1fb66f34bc
even after it was reported a build failure in mesa-gl
This is also showing up on arm architecture now
| /usr/src/debug/glibc/2.24-r0/git/csu/elf-init.c:87: undefined reference to `__init_array_end'
| /usr/src/debug/glibc/2.24-r0/git/csu/elf-init.c:87: undefined reference to `__init_array_start'
| /a/builder/mnt/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/arm-oe-linux-gnueabi/gcc/arm-oe-linux-gnueabi/6.2.0/ld: .libs/mesa_dri_drivers.so: hidden symbol `__init_array_end' isn't defined
(From OE-Core rev: 9211fb2a6d6c2d72ec7c2664737aee3a6b6149cf)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Removed:
change-char-type-to-signed-char-in-macros.patch
sprintf-bug-concerning-8-bit-characters.patch
They are already in the source.
* Updated:
fix-check-pcre.patch
fix-check-pcre.patch
slang-fix-the-iconv-existence-checking.patch
* Use SECURITY_NO_PIE_CFLAGS for SECURITY_CFLAGS, it can't be built with
"-pie -fpie":
tmp/sysroots/qemux86-64/usr/lib64/../lib64/Scrt1.o: In function `_start':
/usr/src/debug/glibc/2.24-r0/git/csu/../sysdeps/x86_64/start.S:104: undefined reference to `main'
/tmp/ccMFTA8A.o: In function `smg_char_at':
/usr/src/debug/slang/2.3.0-r0/slang-2.3.0/modules/slsmg-module.c:134: undefined reference to `SLsmg_char_at'
/tmp/ccMFTA8A.o: In function `smg_resume_smg':
(From OE-Core rev: b2d6e069b9ecc5a13754393200a6fa48cdaaf4c6)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These recipes no longer seem to need full exclusion from security hardening.
The rest (glibc, gcc-runtime, valgrind, grub, grub-efi, uclibc) still do.
[YOCTO #9489]
(From OE-Core rev: b3d7aae42550fb92bcb82fdee7e518b04bdf49b4)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The entry is same as for python-numpy and prevents build failures
when extra security flags are in use (e.g. in poky-lsb).
(From OE-Core rev: 4a95989848df62b34e3115c7e81d4f005de74119)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch avoids unzip fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security).
[YOCTO #9551]
(From OE-Core rev: 2dd1c02fbc7492002df9030f50710e242369e8b2)
Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This avoids makedevs failure to compile with compiler flags
which elevate common string formatting issues into an error
(-Wformat -Wformat-security -Werror=format-security).
[YOCTO #9549]
(From OE-Core rev: f6b0dd13ac90bb431bb51e0cbf1681a4d9fbea14)
Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch avoids zip recipe fails to compile with compiler
flags which elevate common string formatting issues into an
error (-Wformat -Wformat-security -Werror=format-security).
[YOCTO #9552]
(From OE-Core rev: f63a36360b7e138d2a63c84b5b1a8287ffe3d2ae)
Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch avoids stat fails to compile with compiler flags which
elevate common string formatting issues into an error (-Wformat
-Wformat-security -Werror=format-security).
[YOCTO #9550]
(From OE-Core rev: f03c1f41933e9997a01a8b1dcdf9fb18579de1d1)
Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now we have patches that solves the security formatting issues into
those packages.
(From OE-Core rev: 901cfa5a217f78464f8b81a990039fe60810650f)
Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add "-Wformat -Wformat-security -Werror=format-security" to the default
SECURITY_CFLAGS to catch potential security vulnerabilities due to the
misuse of various string formatting functions.
These flags are widely used in distributions such as Fedora and Ubuntu,
however we have 15 recipes in OE-Core which fail to build with these
flags included and thus the flags are removed for:
- busybox
- console-tools
- cmake
- expect
- gcc
- gettext
- kexec-tools
- leafpad
- libuser
- ltp
- makedevs
- oh-puzzles
- stat
- unzip
- zip
[YOCTO #9488]
(From OE-Core rev: f335f8e744fb312b3eb599c331d08a9a6e5a8ff8)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
RPM interally has support to build and work with the stack protector.
This is disabled by default in the RPM package, and the proper settings
should be specified in the security_flags. Using the default setting of
stack-protector-strong causes linking problems due to issues with libtool
selecting the wrong GCC objections to link against.
Falling back to the RPM values of stack-protector will permit linking to
work properly, and some level of protection.
(From OE-Core rev: 98b5f1ef188965f0116ebbe00be746dceb96936e)
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libtool decides to
filter out -fstack-protector-strong on its own and its documented here
https://www.gnu.org/software/libtool/manual/html_node/Stripped-link-flags.html
this causes linking errors when linking libbfd.so since objects (.o) are
compiled using -fstack-protector-strong so they are expecting to link
with libssp but the option goes missing in linker flags.
With this patch the security flags are hoisted upto CC itself and
libtool thankfully does not touch CC.
Adding to CC also means that we can now remove it from LDFLAGS since
when gcc driver is used to do linking then we have LD = CC and this
option makes to linker cmdline
Since CC is used without CFLAGS in configure tests, some tests fail
complaining that -Olevel is not used while using _FORTIFY_SOURCE
therefore added SELECTED_OPTIMIZATION to TARGET_CC_ARCH as well
(From OE-Core rev: 9349f28531619a4ff15c382dacc460d61e3ec7af)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It causes a catch-22 situation where we build libssp in gcc-runtime but also
pass -fstack-protector flags which require libssp
(From OE-Core rev: 61ef8212cc6880f502f1e05e2683d232ea782ae4)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As otherwise the security flags can leak into target builds. This can result in
flags that the host compiler doesn't support, causing build failures.
(From OE-Core rev: ff2c8af73046f55aa733ce8289b6236c88300290)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sysroots/x86_64-linux/usr/libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/5.3.0/ld:
syslinux.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used
when making a shared object; recompile with -fPIC
(From OE-Core rev: b87a9c82663446fa8c002e144de57127e8902b54)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The curl configure script contains sanity checks for unexpected
options being passed via CFLAGS, LDFLAGS, etc. environment variables.
These sanity checks catch -Dxxx options in CFLAGS, which clashes with
OE's approach of using CFLAGS to pass -D_FORTIFY_SOURCE (curl's
configure script suggests, quite correctly, that -Dxxx options should
be passed via CPPFLAGS instead).
These sanity checks previously generated fatal errors, but have been
downgraded to warnings since curl v7.32. Therefore the workaround of
avoiding -D_FORTIFY_SOURCE for curl is obsolete and can be removed.
5d3cbde72e
(From OE-Core rev: d0dfd7bf9b2d6fb269f4d9b62263fd7ccc805fde)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Valgrind (v3.11.0) expects to build with stack protection disabled
and includes -fno-stack-protector in its default CFLAGS. However, the
CFLAGS provided by OE are included on the compiler command line after
the defaults so any -fstack-protector-all / -fstack-protector-strong
option provided by security_flags.inc will cause problems.
| .../build-bcm97425vms/tmp/work/mips32el-rdk-linux/valgrind/3.11.0-r0/valgrind-3.11.0/coregrind/m_mallocfree.c:892: undefined reference to `__stack_chk_guard'
| .../build-bcm97425vms/tmp/work/mips32el-rdk-linux/valgrind/3.11.0-r0/valgrind-3.11.0/coregrind/m_mallocfree.c:947: undefined reference to `__stack_chk_fail'
(From OE-Core rev: ff4f46700a4810fcb49c58978b17af4f52fa9925)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
webkitgtk 2.8.3 is provided instead and midori browser is replaced by epiphany in
separate commits.
(From OE-Core rev: 1a72dc9c44c7806c869c3b3afcd5d31bcf2da979)
(From OE-Core rev: 68a1e346751c4d644a14035b0d7acf01d212f38c)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
