linux/poky.git/meta/conf/distro/include/security_flags.inc, branch master-next2

security_flags.inc: Add overrides for glibc-testsuite to match glibc

2019-09-06T11:45:47+00:00

Ensure glibc-testsuite has the same flags as glibc. (From OE-Core rev: f8ab08441f90eb75295304c57746c6e5f907ca64) Signed-off-by: Nathan Rossi Signed-off-by: Richard Purdie

Clean up remnants of glibc-initial

2019-09-06T07:15:45+00:00

Remove remnants of the glibc-initial recipe. (From OE-Core rev: 332b1e21db3e0cbeeb14f12dd6aeedb89b76d761) Signed-off-by: Nathan Rossi Signed-off-by: Richard Purdie

security_flags.inc: add var-SECURITY_STACK_PROTECTOR to improve variable OVERRIDES

2018-09-04T10:03:55+00:00

There are var-SECURITY_PIE_CFLAGS, var-lcl_maybe_fortify and var-SECURITY_STRINGFORMAT which are helpful for OVERRIDES. Also add var-SECURITY_STACK_PROTECTOR, and drop hardcoded `_remove' overrides. Such as `4ca946c security_flags: use -fstack-protector-strong', it s/-fstack-protector-all/-fstack-protector-strong/, only tweak var-SECURITY_STACK_PROTECTOR is sufficient. The fix does not have any side affect on SECURITY_CFLAGS of glibc/ glibc-initial/gcc-runtime, these three directly assigned with "". ... SECURITY_CFLAGS_pn-glibc = "" SECURITY_CFLAGS_pn-glibc-initial = "" SECURITY_CFLAGS_pn-gcc-runtime = "" ... (From OE-Core rev: 0ed4a6233bdcb25cbdce698504611541420d92d0) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

security_flags.inc: use `?=' to set a default var-lcl_maybe_fortify

2018-09-04T10:03:55+00:00

- Since poky enable security flags+pie by default, tweak comments to sync with it. [poky commit] 491082c poky.conf: Enable security flags+pie by default 29d76b3 poky-lsb: Remove including security_flags.inc [poky commit] - Use `?=' to set a default lcl_maybe_fortify, it is helpful for variable OVERRIDES. (From OE-Core rev: 38c410bb7d1688cd952da9f19269c2a65a92ab45) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

powerpc: Remove pie flags from compiler cmdline

2018-08-20T16:38:22+00:00

Original approach to add -no- flags cause link time behavior changes where packages start to lose the -fPIC -DPIC in compiler cmdline and this list keeps growing as we build more and more packages, Instead lets just remove the options we dont need from SECURITY_CFLAGS this makes it more robust and less intrusive This also means we do not need to re-add pic options as we started to do for affected packages (From OE-Core rev: 1520f5a345fd03d46f33f0efaf76191e96344bec) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

security_flags: Add PIC to cflags for some recipes on ppc

2018-08-16T08:49:38+00:00

Fixes issues related out of range R_PPC_REL24 e.g. /usr/lib/xorg/modules/input/libinput_drv.so: /usr/lib/libinput.so.10: R_PPC_REL24 relocation at 0x0e8602c4 for symbol `libevdev_has_event_code' out of range (From OE-Core rev: 48c8d13a9bdcacb64a330074588f7c6bb5cae90d) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

security_flags.inc: drop obsolete comment

2018-05-15T09:56:50+00:00

The last ARM specific over-ride was removed in: http://git.openembedded.org/openembedded-core/commit/?id=e93765ffb5718b0fce84f0b8123963176dea95e4 but the comment was accidentally left behind. (From OE-Core rev: efcf629e2d84bacb955201d1960969020796678e) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

security_flags: disable static PIE in glibc

2018-05-15T09:56:48+00:00

Static PIE doesn't work entirely right in GCC 7, for example ldconfig on ARM with the flags enabled will something segfault during initialisation. To mitigate this until we have GCC 8 integrated, don't enable static PIE. (From OE-Core rev: 5f64946b8740a5d944f48ec430470265703bfe5e) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

glibc: Enable static PIE support when security_flags are enabled

2018-03-01T22:18:47+00:00

(From OE-Core rev: 8e4ece7bf0b09275a34ce8e7cc3e1e54a366c361) Signed-off-by: Khem Raj Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

security_flags.inc, xorg-driver-common.inc: Move SECURITY_X_LDFLAGS logic

2018-02-06T11:06:27+00:00

We need to ensure that all xorg modules are linked with SECURITY_X_LDFLAGS to ensure that they will be able to resolve their run time dependencies. The approach of listing each driver in security_flags.inc lets less frequently used drivers be run-time broken. Move the flag logic into xorg-driver-common.inc so that all xorg modules from all layers will have the correct security flags used. Cc: Khem Raj (From OE-Core rev: 27fce6ec277788f8fad0c9799e784df80f791120) Signed-off-by: Tom Rini Signed-off-by: Ross Burton Signed-off-by: Richard Purdie