summaryrefslogtreecommitdiffstats
path: root/meta/conf/distro/include/security_flags.inc
AgeCommit message (Collapse)Author
2015-08-09security_flags.inc: disable -pie and -fpie from Python3 compilation.Topi Kuutela
If security_flags.inc is 'required' to the image, -pie and -fpie options are added to CFLAGS. These are not compatible with -shared GCC option. The result is several errors of following form and missing Python3 modules in the image: *.o In function `_start': *.S undefined reference to `main' collect2: error: ld returned 1 exit status (From OE-Core rev: 94818c5240b793464700945d0cf057bffb9e1008) Signed-off-by: Topi Kuutela <topi.kuutela@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-27security-flags: Disable PIE for coreutils, elfutils, gcc, iptablesRichard Purdie
With gcc 5, we need to disable the PIE flags for more recipes in order to have successful builds. (From OE-Core rev: ec2f1b5af102ab6a8fcc23bf115c8f0451ab7eb8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-08security_flags: eliminate FORTIFY_SOURCE for debug buildsJoe Slater
If -D_FORTIFY_SOURCE=2 is included in CFLAGS for debug builds, many warnings will be generated and some packages will fail to build. So, only conditionally include it. (From OE-Core rev: 1b576012a6a2b2ebc2c507cdaebd62174810b191) Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-06-23security_flags.inc: remove duplicated over-ridesAndre McCurdy
The following over-rides were both defined twice: SECURITY_CFLAGS_pn-grub-efi-x86-64-native SECURITY_CFLAGS_pn-ltp (From OE-Core rev: dfae10889ab0fce2bae94294a78f4ea0aaf1b81e) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-30security_flags: Add comment about what it does and who uses itRichard Purdie
It was pointed out that people couldn't easily see who used this or why so add some comments about that. (From OE-Core rev: 67f09e9086b8fb1c0c8a1dd19419afb1a5af8daf) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-03security_flags: Add python-numpy to pie incompatible listRichard Purdie
With poky-lsb (security flags enabled), python-numpy doesn't build with pie flags. (From OE-Core rev: d4694ac5e18db1d0db314d0d8b1104c073037a60) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-09security_flags.inc: elfutils on ARM fails with PIE flagsDenys Dmytriyenko
The error messages look like this: R_ARM_TLS_LE32 relocation not permitted in shared object (From OE-Core rev: a915adfd1eaad9a0d65dffe9da92811284e491c8) Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-02security_flags: remove PIE flags from flex and gstreamer1.0-plugins-badRoss Burton
These recipes both fail to build with "relocation R_X86_64_PC32 against undefined hidden symbol `__init_array_start' can not be used when making a shared object" when using PIE. (From OE-Core rev: 37e6e62f0faae3fa16421b051599aea0e03a5825) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-01-29security_flags: disable PIE on expectRoss Burton
Disable PIE in expect as otherwise it tries to link the shared library as an executable. (From OE-Core rev: fe1f5c90eede593100fe57630d39cf329e59ef8f) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-01-23gcc-sanitizers: Enable GCC sanitizersDan McGregor
AddressSanitizer is a fast memory error detector. ThreadSanitizer detects data races. UBSanitizer detectes undefined behaviour. All consist of compiler instrumentation and a run-time library. The compiler instrumentation was already enabled, this builds the run-time library component. (From OE-Core rev: 1709bf0c3a84bb04bc52e9104ad8e09fba6c6f91) Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-01-16security_flags: disable pie support for libaio, blktrace and ltpSaul Wold
libaio when built with pie and fpie does not link correctly with blktrace or ltp so we need to disable those flags until a better solution comes along. (From OE-Core rev: 4fbf13a6c28fc1170a4defbf50032546a14eaa59) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-12-19security_flags: Fix typo for cupsRichard Purdie
(From OE-Core rev: 146b1ea632294b2830e2cfe2d1258d48cd0c0e85) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-09-01distro: TCLIBC now defines glibc instead of eglibcKhem Raj
Adjust naming conventions to reflect eglibc->glibc move (From OE-Core rev: ce3f296ec9021d207cb80cb2c697932b83fd0e81) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-05security_flags: Update to correctly link X modulesSaul Wold
Remove the -z,now flag from linking [YOCTO #5885] (From OE-Core rev: 545986bfbfe20f2b6e8a46e88e2cc3007ca344e6) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-26security-flags: Avoid lttng-tools issue on armRichard Purdie
(From OE-Core rev: 010d5b437413156c3f4dc90a14698231bb195c2e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-26security-flags: Deal with powerpc build issuesRichard Purdie
Building powerpc machines with the standard security flags generated numerous build failures. Use a reduced set of flags for now to avoid linker issues and other compile failures. (From OE-Core rev: 4ef8f658874282ead0c46352474fdb03ad1f1038) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-26security_flags: disable PIE flags for cups buildsSaul Wold
(From OE-Core rev: c564bffe7a32470578a22b70e868e7bec2da0a69) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-14security_flags: db can't use pie flags from gcc for security buildSaul Wold
[YOCTO #5721] (From OE-Core rev: 0cfe254e7eafed27f512216cccfb7fee76fc0be7) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-06security_flags: add the rest of the grub-efi related packagesSaul Wold
[YOCTO #5515] (From OE-Core rev: 840fd855a47b0a557911ae0542ed24a047af6d7b) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-12-18security_flags: more relocation issuesSaul Wold
These are similar relocation R_X86_64_PC32 issues that are solved by removing the -pie flags. [YOCTO #5515] (From OE-Core rev: cd94dd3d9bba32c3fd55959586128b236d1d4e34) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-12-05security_flags: Add entry for opensslSaul Wold
It seems we might be stumbling over an obscure linkage issues possibly similar to http://marc.info/?l=openssl-dev&m=130132183118768&w=2 This issue appears for x86-64 systems with the PIE related compiler flags. libcrypto.a(cryptlib.o): relocation R_X86_64_PC32 against symbol `OPENSSL_showfatal' can not be used when making a shared object; recompile with -fPIC The error suggests recompiling with -fPIC, but it is already compiled that way. Disable the PIE flags makes it work for now, I have posted to openssl ML [YOCTO #5515] (From OE-Core rev: 55e1c0e66fd16612016b3e415cbfa4e3051e5a8f) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-11-24security_flags: grub-efi-natve does not build with flags enabledSaul Wold
[YOCTO #5505] (From OE-Core rev: db628ccad9db49d0e83fb534ddfb05a57132f2fa) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-09-17mesa-gl: add GL-only Mesa recipeRoss Burton
Some machines have hardware-specific GL drivers that do EGL and GLES (many ARM boards). Others have their own EGL/GLES drivers and provide a Mesa DRI driver (EMGD). Previously adding Mesa, for software GL/GLX rendering in the first case and hardware GLX in the second, involved bbappends and changing Mesa to be machine-specific. By adding a just-GL Mesa the machine definition can combine it with the hardware drivers cleanly. (From OE-Core rev: f5a3a4bc33109181c741a2e66c13d0b45566e8fa) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-10security_flags: Add addition recipes to the non pie listSaul Wold
Create a local SECURITY_NO_PIE_CFLAGS to cover the recipes that have issues with with pic and pie cflags set. (From OE-Core rev: 4f5009dcbbeb27bdf5dcaebb3b457fecef410ebe) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-02security_flags: Add the compiler and linker flags that enhance securitySaul Wold
These flags add addition checks at compile, link and runtime to prevent stack smashing, checking for buffer overflows, and link at program start to prevent call spoofing later. This needs to be explicitly enabled by adding the following line to your local.conf: require conf/distro/include/security_flags.inc [YOCTO #3868] (From OE-Core rev: ff0e863f2d345c42393a14a193f76d699745a2b9) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-23 22:12:24 +0000