diff options
Diffstat (limited to 'meta/conf/distro/include/security_flags.inc')
-rw-r--r-- | meta/conf/distro/include/security_flags.inc | 66 |
1 files changed, 33 insertions, 33 deletions
diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index f996ca9be2..d97a6edb0f 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc | |||
@@ -1,6 +1,6 @@ | |||
1 | # Setup extra CFLAGS and LDFLAGS which have 'security' benefits. These | 1 | # Setup extra CFLAGS and LDFLAGS which have 'security' benefits. These |
2 | # don't work universally, there are recipes which can't use one, the other | 2 | # don't work universally, there are recipes which can't use one, the other |
3 | # or both so a blacklist is maintained here. The idea would be over | 3 | # or both so an override is maintained here. The idea would be over |
4 | # time to reduce this list to nothing. | 4 | # time to reduce this list to nothing. |
5 | # From a Yocto Project perspective, this file is included and tested | 5 | # From a Yocto Project perspective, this file is included and tested |
6 | # in the DISTRO="poky" configuration. | 6 | # in the DISTRO="poky" configuration. |
@@ -32,40 +32,40 @@ SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" | |||
32 | SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" | 32 | SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" |
33 | 33 | ||
34 | # powerpc does not get on with pie for reasons not looked into as yet | 34 | # powerpc does not get on with pie for reasons not looked into as yet |
35 | GCCPIE_powerpc = "" | 35 | GCCPIE:powerpc = "" |
36 | GLIBCPIE_powerpc = "" | 36 | GLIBCPIE:powerpc = "" |
37 | SECURITY_CFLAGS_remove_powerpc = "${SECURITY_PIE_CFLAGS}" | 37 | SECURITY_CFLAGS:remove:powerpc = "${SECURITY_PIE_CFLAGS}" |
38 | SECURITY_CFLAGS_pn-libgcc_powerpc = "" | 38 | SECURITY_CFLAGS:pn-libgcc:powerpc = "" |
39 | 39 | ||
40 | SECURITY_CFLAGS_pn-glibc = "" | 40 | SECURITY_CFLAGS:pn-glibc = "" |
41 | SECURITY_CFLAGS_pn-glibc-testsuite = "" | 41 | SECURITY_CFLAGS:pn-glibc-testsuite = "" |
42 | SECURITY_CFLAGS_pn-gcc-runtime = "" | 42 | SECURITY_CFLAGS:pn-gcc-runtime = "" |
43 | SECURITY_CFLAGS_pn-grub = "" | 43 | SECURITY_CFLAGS:pn-grub = "" |
44 | SECURITY_CFLAGS_pn-grub-efi = "" | 44 | SECURITY_CFLAGS:pn-grub-efi = "" |
45 | SECURITY_CFLAGS_pn-mkelfimage_x86 = "" | 45 | SECURITY_CFLAGS:pn-mkelfimage:x86 = "" |
46 | 46 | ||
47 | SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NOPIE_CFLAGS}" | 47 | SECURITY_CFLAGS:pn-valgrind = "${SECURITY_NOPIE_CFLAGS}" |
48 | SECURITY_LDFLAGS_pn-valgrind = "" | 48 | SECURITY_LDFLAGS:pn-valgrind = "" |
49 | SECURITY_CFLAGS_pn-sysklogd = "${SECURITY_NOPIE_CFLAGS}" | 49 | SECURITY_CFLAGS:pn-sysklogd = "${SECURITY_NOPIE_CFLAGS}" |
50 | SECURITY_LDFLAGS_pn-sysklogd = "" | 50 | SECURITY_LDFLAGS:pn-sysklogd = "" |
51 | 51 | ||
52 | # Recipes which fail to compile when elevating -Wformat-security to an error | 52 | # Recipes which fail to compile when elevating -Wformat-security to an error |
53 | SECURITY_STRINGFORMAT_pn-busybox = "" | 53 | SECURITY_STRINGFORMAT:pn-busybox = "" |
54 | SECURITY_STRINGFORMAT_pn-gcc = "" | 54 | SECURITY_STRINGFORMAT:pn-gcc = "" |
55 | 55 | ||
56 | TARGET_CC_ARCH_append_class-target = " ${SECURITY_CFLAGS}" | 56 | TARGET_CC_ARCH:append:class-target = " ${SECURITY_CFLAGS}" |
57 | TARGET_LDFLAGS_append_class-target = " ${SECURITY_LDFLAGS}" | 57 | TARGET_LDFLAGS:append:class-target = " ${SECURITY_LDFLAGS}" |
58 | TARGET_CC_ARCH_append_class-cross-canadian = " ${SECURITY_CFLAGS}" | 58 | TARGET_CC_ARCH:append:class-cross-canadian = " ${SECURITY_CFLAGS}" |
59 | TARGET_LDFLAGS_append_class-cross-canadian = " ${SECURITY_LDFLAGS}" | 59 | TARGET_LDFLAGS:append:class-cross-canadian = " ${SECURITY_LDFLAGS}" |
60 | 60 | ||
61 | SECURITY_STACK_PROTECTOR_pn-gcc-runtime = "" | 61 | SECURITY_STACK_PROTECTOR:pn-gcc-runtime = "" |
62 | SECURITY_STACK_PROTECTOR_pn-glibc = "" | 62 | SECURITY_STACK_PROTECTOR:pn-glibc = "" |
63 | SECURITY_STACK_PROTECTOR_pn-glibc-testsuite = "" | 63 | SECURITY_STACK_PROTECTOR:pn-glibc-testsuite = "" |
64 | SECURITY_STACK_PROTECTOR:pn-ltp = "" | ||
64 | # All xorg module drivers need to be linked this way as well and are | 65 | # All xorg module drivers need to be linked this way as well and are |
65 | # handled in recipes-graphics/xorg-driver/xorg-driver-common.inc | 66 | # handled in recipes-graphics/xorg-driver/xorg-driver-common.inc |
66 | SECURITY_LDFLAGS_pn-xserver-xorg = "${SECURITY_X_LDFLAGS}" | 67 | SECURITY_LDFLAGS:pn-xserver-xorg = "${SECURITY_X_LDFLAGS}" |
67 | 68 | ||
68 | TARGET_CC_ARCH_append_pn-binutils = " ${SELECTED_OPTIMIZATION}" | 69 | TARGET_CC_ARCH:append:pn-binutils = " ${SELECTED_OPTIMIZATION}" |
69 | TARGET_CC_ARCH_append_pn-gcc = " ${SELECTED_OPTIMIZATION}" | 70 | TARGET_CC_ARCH:append:pn-gcc = " ${SELECTED_OPTIMIZATION}" |
70 | TARGET_CC_ARCH_append_pn-gdb = " ${SELECTED_OPTIMIZATION}" | 71 | TARGET_CC_ARCH:append:pn-gdb = " ${SELECTED_OPTIMIZATION}" |
71 | TARGET_CC_ARCH_append_pn-perf = " ${SELECTED_OPTIMIZATION}" | ||