summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKhem Raj <raj.khem@gmail.com>2016-02-05 16:52:41 +0000
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-02-07 17:29:59 +0000
commit61a58752f441db0550d0c7430fa110cebbf88ccd (patch)
treea58859e868c6638ac49ea5ee737fd1c2ec8e2fdb
parenta07f2fddbc4cecdeb76339ba4094774c63119513 (diff)
downloadpoky-61a58752f441db0550d0c7430fa110cebbf88ccd.tar.gz
security_flags: use -fstack-protector-strong
This is a better version of -fstack-protector-all with reduced stack usage and better performance yet giving same amount of coverage. It's available in gcc 4.9 onwards. https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/ has more details. (From OE-Core rev: 4ca946c029f04ba3991ed0f1f65355a7a7840ff4) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/conf/distro/include/security_flags.inc10
1 files changed, 5 insertions, 5 deletions
diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
index 72d31ba67b..5e0ef634bf 100644
--- a/meta/conf/distro/include/security_flags.inc
+++ b/meta/conf/distro/include/security_flags.inc
@@ -9,14 +9,14 @@
9# -O0 which then results in a compiler warning. 9# -O0 which then results in a compiler warning.
10lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" 10lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}"
11 11
12SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}" 12SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify}"
13SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}" 13SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify}"
14 14
15SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" 15SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now"
16SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" 16SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro"
17 17
18# powerpc does not get on with pie for reasons not looked into as yet 18# powerpc does not get on with pie for reasons not looked into as yet
19SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}" 19SECURITY_CFLAGS_powerpc = "-fstack-protector-strong ${lcl_maybe_fortify}"
20# Deal with ppc specific linker failures when using the cflags 20# Deal with ppc specific linker failures when using the cflags
21SECURITY_CFLAGS_pn-dbus_powerpc = "" 21SECURITY_CFLAGS_pn-dbus_powerpc = ""
22SECURITY_CFLAGS_pn-dbus-ptest_powerpc = "" 22SECURITY_CFLAGS_pn-dbus-ptest_powerpc = ""