From fa7db243672ec7d8e1a1f45341ceadb0bc212794 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Tue, 9 Feb 2021 23:40:44 -0800 Subject: security_flags.inc: Add same O as in SELECTED_OPTIMIZATION Adding -O can be troublesome in some packages where it may override the O specified by CFLAGS, this can be due to configure processing of CFLAGS and munging them into new values in Makefiles, which is contructed from CC and CFLAGS passed by bitbake environment. Problem arises if the sequence is altered, which seems to be the case in some packages e.g. ncurses, where the value from CC variable is added last and thus overrides -O coming from CFLAGS, Therefore grok the value from SELECTED_OPTIMIZATION and append the appropriate -O flag to lcl_maybe_fortify so the level does not change inaderdantly. Since we do not use -O0 anymore there is no point of checking for DEBUG_BUILD since it uses -Og now which works fine with -D_FORTIFY_SOURCE=2, so check for optlevel O0 instead (From OE-Core rev: 9571a18f7d15b3bffafc2e277ab90a21d6763697) Signed-off-by: Khem Raj Cc: Anuj Mittal Signed-off-by: Richard Purdie --- meta/conf/distro/include/security_flags.inc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'meta/conf') diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index 05253b2df9..f996ca9be2 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc @@ -10,7 +10,9 @@ GCCPIE ?= "--enable-default-pie" # _FORTIFY_SOURCE requires -O1 or higher, so disable in debug builds as they use # -O0 which then results in a compiler warning. -lcl_maybe_fortify ?= "${@oe.utils.conditional('DEBUG_BUILD','1','','-O -D_FORTIFY_SOURCE=2',d)}" +OPTLEVEL = "${@bb.utils.filter('SELECTED_OPTIMIZATION', '-O0 -O1 -O2 -O3 -Ofast -Og -Os -Oz -O', d)}" + +lcl_maybe_fortify ?= "${@oe.utils.conditional('OPTLEVEL','-O0','','${OPTLEVEL} -D_FORTIFY_SOURCE=2',d)}" # Error on use of format strings that represent possible security problems SECURITY_STRINGFORMAT ?= "-Wformat -Wformat-security -Werror=format-security" -- cgit v1.2.3-54-g00ecf