linux/poky.git/meta/conf/distro/include/security_flags.inc, branch halstead/hashclient

perf: lift TARGET_CC_ARCH modification out of security_flags.inc

2023-10-25T09:20:39+00:00

Building perf without security_flags.inc being included in one's distro results in the buildpaths warning WARNING: perf-1.0-r9 do_package_qa: QA Issue: File /usr/bin/trace in package perf contains reference to TMPDIR because the ${DEBUG_PREFIX_MAP} does not get used. Most recipes get that from CFLAGS, but the perf recipe explicitly unsets that. Now ${SELECTED_OPTIMIZATION} of course contains more than just ${DEBUG_FLAGS}/${DEBUG_PREFIX_MAP}. For most TUs, perf's build system adds its own optimization flags (-O6 for odd reasons), so for those including the -O2 or -Og doesn't change anything. But looking at the .o.cmd files show that there are some TUs which currently get built without any -O flag. So for those adding the distro's SELECTED_OPTIMIZATION seem to be the right thing to do. (From OE-Core rev: aa01c9122ef4a2159df503ef6ed25e802277f13a) Signed-off-by: Rasmus Villemoes Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

ltp: upgrade 20220121 -> 20220527

2022-06-07T20:21:55+00:00

Disable stack protection as newly added kvm tests won't build with it. (From OE-Core rev: f231bc2c28226776f0990ec65aa5f95e89021218) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

meta/scripts: Improve internal variable naming

2022-03-10T08:00:28+00:00

Update internal variable names to improve the terms used. (From OE-Core rev: f408068e5d7998ae165f3002e51bc54b380b8099) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

Convert to new override syntax

2021-08-02T14:44:10+00:00

This is the result of automated script conversion: scripts/contrib/convert-overrides.py converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie

security_flags.inc: Add same O as in SELECTED_OPTIMIZATION

2021-02-12T23:32:16+00:00

Adding -O can be troublesome in some packages where it may override the O specified by CFLAGS, this can be due to configure processing of CFLAGS and munging them into new values in Makefiles, which is contructed from CC and CFLAGS passed by bitbake environment. Problem arises if the sequence is altered, which seems to be the case in some packages e.g. ncurses, where the value from CC variable is added last and thus overrides -O coming from CFLAGS, Therefore grok the value from SELECTED_OPTIMIZATION and append the appropriate -O flag to lcl_maybe_fortify so the level does not change inaderdantly. Since we do not use -O0 anymore there is no point of checking for DEBUG_BUILD since it uses -Og now which works fine with -D_FORTIFY_SOURCE=2, so check for optlevel O0 instead (From OE-Core rev: 9571a18f7d15b3bffafc2e277ab90a21d6763697) Signed-off-by: Khem Raj Cc: Anuj Mittal Signed-off-by: Richard Purdie

security_flags.inc: Use -O with -D_FORTIFY_SOURCE

2021-02-08T14:47:16+00:00

compiler can only use fortify options when some level of optimization is on, otherwise it ends up sending some warnings. warning: _FORTIFY_SOURCE requires compiling with optimization (-O) [-W#warnings] this is usually OK, since -O would be added via CFLAGS to compiler cmdline in normal compile stages, however during configure there are problems when CC,CPP,CXX are probed alone in configure tests which results in above warning, which confuses the configure results and autotools 2.70+ detects it as error e.g. configure:17292: error: C preprocessor "riscv32-yoe-linux-clang -target riscv32-yoe-linux -mlittle-endian -mno-relax -Qunused-arguments -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/mnt/b/yoe/master/build/tmp/work/riscv32-yoe-linux/ndpi/3.4-r0/recipe-sysroot -E" fails sanity check See `config.log' for more details therefore adding a -O ( which actually is -O1 ) to lcl_maybe_fortify means we can properly test these configure tests and real -O will still override -O added here, so overrall behavior improves (From OE-Core rev: b6113dd68caa46d56cf3c8293119f2b9d8b137fd) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

grub: Remove native version of grub-efi

2020-06-23T11:31:03+00:00

The native version of grub-efi only installs the tools /usr/bin/grub-editenv /usr/bin/grub-mkimage to sysroots-components/, but equivalent tools are already provided by grub-native, the difference on x86_64 being 4 hardwired paths in grub-mkimage (values taken from grub-native): LOCALEDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/share/locale GRUB_DATADIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/share GRUB_LIBDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/usr/lib GRUB_SYSCONFDIR = $TMPDIR/work/x86_64-linux/grub-native/2.04-r0/recipe-sysroot-native/etc If grub-native and grub-efi-native are built with the following patch --- grub-2.04.orig/configure.ac +++ grub-2.04/configure.ac @@ -1980,10 +1980,10 @@ grub_libdir="$(eval echo "$libdir")" grub_localedir="$(eval echo "$localedir")" grub_datadir="$(eval echo "$datadir")" grub_sysconfdir="$(eval echo "$sysconfdir")" -AC_DEFINE_UNQUOTED(LOCALEDIR, "$grub_localedir", [Locale dir]) -AC_DEFINE_UNQUOTED(GRUB_LIBDIR, "$grub_libdir", [Library dir]) -AC_DEFINE_UNQUOTED(GRUB_DATADIR, "$grub_datadir", [Data dir]) -AC_DEFINE_UNQUOTED(GRUB_SYSCONFDIR, "$grub_sysconfdir", [Configuration dir]) +AC_DEFINE_UNQUOTED(LOCALEDIR, "/non-existent", [Locale dir]) +AC_DEFINE_UNQUOTED(GRUB_LIBDIR, "/non-existent", [Library dir]) +AC_DEFINE_UNQUOTED(GRUB_DATADIR, "/non-existent", [Data dir]) +AC_DEFINE_UNQUOTED(GRUB_SYSCONFDIR, "/non-existent", [Configuration dir]) the produced grub-editenv/grub-mkimage binaries become binary equivalent, assuming reproducible builds is active. Since the unpatched values of LOCALEDIR/GRUB_DATADIR/GRUB_LIBDIR/GRUB_SYSCONFDIR point to directories that are not expected to exist at runtime, they can be ignored. Therefore: * remove grub-efi-native and instead rely on the same tools from grub-native * replace references to grub-efi-native with grub-native * remove unused grub-efi-native security flags overrides (From OE-Core rev: 7044181df7487f047d175242f7ebbc3c35bf5402) Signed-off-by: Jacob Kroon Signed-off-by: Richard Purdie

security_flags: Remove stack protector flag from LDFLAGS

2020-06-04T12:27:32+00:00

SECURITY_LDFLAGS contains stack protector flag inappropriately, which has already be contained in SECURITY_CFLAGS. Let's remove it from SECURITY_LDFLAGS. (From OE-Core rev: 549cce578b859986e37900bf15c1bf904d33e47b) Signed-off-by: Junling Zheng Signed-off-by: Richard Purdie

security_flags.inc: fix flags missing from SDK toolchain

2020-03-25T10:02:49+00:00

The security flags were missing from the SDK toolchain because they were added specifically to class-target. Add them to class-cross-canadian as well (since the SDK environment file is created from cross-canadian target flags). (From OE-Core rev: cd46e8f890069a40d1e9048cfa0f378dec1dc5e9) Signed-off-by: Tom Hochstein Signed-off-by: Antoine Manache Signed-off-by: Richard Purdie

security_flags.inc: Add overrides for glibc-testsuite to match glibc

2019-09-06T11:45:47+00:00

Ensure glibc-testsuite has the same flags as glibc. (From OE-Core rev: f8ab08441f90eb75295304c57746c6e5f907ca64) Signed-off-by: Nathan Rossi Signed-off-by: Richard Purdie