klibc: Fix build with security flags

Drop -Os which is also causing the relro
Fixes
| x86_64-bec-linux-musl-ld.bfd: discarded output section: `.got.plt'

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Andrea Adami <andrea.adami@gmail.com>

2 files changed, 33 insertions, 4 deletions

diff --git a/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch b/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch
new file mode 100644
index 000000000..94818e366
--- /dev/null
+++ b/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch
@@ -0,0 +1,28 @@
+From cdc6edc2cfcd0ce88d6e66654d605dad303b1a75 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 11 Sep 2018 17:03:36 -0700
+Subject: [PATCH] klibc/Kbuild: Accept EXTRA_KLIBCAFLAGS
+
+For passing additional assembler flags
+
+Upstream-Status: Pending
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ usr/klibc/Kbuild | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/usr/klibc/Kbuild b/usr/klibc/Kbuild
+index 98caf2e9..b34521e0 100644
+--- a/usr/klibc/Kbuild
++++ b/usr/klibc/Kbuild
+@@ -168,7 +168,8 @@ $(SOHASH): $(SOLIB) $(SOLIB).hash
+ targets += interp.o
+ 
+ quiet_cmd_interp = BUILD   $@
+-      cmd_interp = $(KLIBCCC) $(klibccflags) -D__ASSEMBLY__     \
++      cmd_interp = $(KLIBCCC) $(klibccflags) $(EXTRA_KLIBCAFLAGS) \
++                             -D__ASSEMBLY__     \
+                              -DLIBDIR=\"$(SHLIBDIR)\"         \
+                             -DSOHASH=\"$(SOLIBHASH)\" \
+                             -c -o $@ $<
diff --git a/meta-initramfs/recipes-devtools/klibc/klibc.inc b/meta-initramfs/recipes-devtools/klibc/klibc.inc
index f0b20bc7f..3d25e96cd 100644
--- a/meta-initramfs/recipes-devtools/klibc/klibc.inc
+++ b/meta-initramfs/recipes-devtools/klibc/klibc.inc
@@ -21,9 +21,10 @@ SRC_URI = "git://git.kernel.org/pub/scm/libs/klibc/klibc.git \
            file://0001-Kbuild.klibc-Use-print-libgcc-file-name-instead-of-p.patch \
            file://0001-Kbuild.klibc-Add-path-to-compiler-headers-via-isyste.patch \
            file://0001-arm-Do-not-set-a-fallback-march-and-mtune.patch \
-           file://0001-klibc_2.0.4-add-kexec_file_load-syscall.patch  \
+           file://0001-klibc_2.0.4-add-kexec_file_load-syscall.patch \
            file://0001-klibc-add-getrandom-syscall.patch \
-"
+           file://0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch \
+           "
 
 ARMPATCHES ?= ""
 
@@ -31,7 +32,6 @@ ARMPATCHES_arm = "file://klibc-config-eabi.patch \
                   file://armv4-fix-v4bx.patch \
                  "
 
-
 S = "${WORKDIR}/git"
 
 PARALLEL_MAKE = ""
@@ -44,9 +44,10 @@ EXTRA_OEMAKE = "'KLIBCARCH=${KLIBC_ARCH}' \
                 'INSTALLDIR=${libdir}/klibc' \
                 'SHLIBDIR=${libdir}' \
                 '${KLIBCTHUMB}' \
-                'KLIBCOPTFLAGS=${TUNE_CCARGS} -Os' \
+                'KLIBCOPTFLAGS=${TUNE_CCARGS}' \
                  V=1 \
                 "
+EXTRA_OEMAKE += 'EXTRA_KLIBCAFLAGS="-Wa,--noexecstack" EXTRA_KLIBCLDFLAGS="-z noexecstack"'
 
 export FIX_ARMV4_EABI_BX = "${FIX_V4BX}"
 KLIBCTHUMB = "${@['CONFIG_KLIBC_THUMB=n', 'CONFIG_KLIBC_THUMB=y'][(d.getVar('ARM_INSTRUCTION_SET') == 'thumb')]}"