1# Setup extra CFLAGS and LDFLAGS which have 'security' benefits. These 2# don't work universally, there are recipes which can't use one, the other 3# or both so a blacklist is maintained here. The idea would be over 4# time to reduce this list to nothing. 5# From a Yocto Project perspective, this file is included and tested 6# in the DISTRO="poky" configuration. 7 8GCCPIE ?= "--enable-default-pie" 9# If static PIE is known to work well, GLIBCPIE="--enable-static-pie" can be set 10 11# _FORTIFY_SOURCE requires -O1 or higher, so disable in debug builds as they use 12# -O0 which then results in a compiler warning. 13lcl_maybe_fortify ?= "${@oe.utils.conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" 14 15# Error on use of format strings that represent possible security problems 16SECURITY_STRINGFORMAT ?= "-Wformat -Wformat-security -Werror=format-security" 17 18# Inject pie flags into compiler flags if not configured with gcc itself 19# especially useful with external toolchains 20SECURITY_PIE_CFLAGS ?= "${@'' if '${GCCPIE}' else '-pie -fPIE'}" 21 22SECURITY_NOPIE_CFLAGS ?= "-no-pie -fno-PIE" 23 24SECURITY_STACK_PROTECTOR ?= "-fstack-protector-strong" 25 26SECURITY_CFLAGS ?= "${SECURITY_STACK_PROTECTOR} ${SECURITY_PIE_CFLAGS} ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}" 27SECURITY_NO_PIE_CFLAGS ?= "${SECURITY_STACK_PROTECTOR} ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}" 28 29SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" 30SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" 31 32# powerpc does not get on with pie for reasons not looked into as yet 33GCCPIE_powerpc = "" 34GLIBCPIE_powerpc = "" 35SECURITY_CFLAGS_remove_powerpc = "${SECURITY_PIE_CFLAGS}" 36SECURITY_CFLAGS_pn-libgcc_powerpc = "" 37 38SECURITY_CFLAGS_pn-glibc = "" 39SECURITY_CFLAGS_pn-glibc-testsuite = "" 40SECURITY_CFLAGS_pn-gcc-runtime = "" 41SECURITY_CFLAGS_pn-grub = "" 42SECURITY_CFLAGS_pn-grub-efi = "" 43SECURITY_CFLAGS_pn-mkelfimage_x86 = "" 44 45SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NOPIE_CFLAGS}" 46SECURITY_LDFLAGS_pn-valgrind = "" 47SECURITY_CFLAGS_pn-sysklogd = "${SECURITY_NOPIE_CFLAGS}" 48SECURITY_LDFLAGS_pn-sysklogd = "" 49 50# Recipes which fail to compile when elevating -Wformat-security to an error 51SECURITY_STRINGFORMAT_pn-busybox = "" 52SECURITY_STRINGFORMAT_pn-gcc = "" 53 54TARGET_CC_ARCH_append_class-target = " ${SECURITY_CFLAGS}" 55TARGET_LDFLAGS_append_class-target = " ${SECURITY_LDFLAGS}" 56TARGET_CC_ARCH_append_class-cross-canadian = " ${SECURITY_CFLAGS}" 57TARGET_LDFLAGS_append_class-cross-canadian = " ${SECURITY_LDFLAGS}" 58 59SECURITY_STACK_PROTECTOR_pn-gcc-runtime = "" 60SECURITY_STACK_PROTECTOR_pn-glibc = "" 61SECURITY_STACK_PROTECTOR_pn-glibc-testsuite = "" 62# All xorg module drivers need to be linked this way as well and are 63# handled in recipes-graphics/xorg-driver/xorg-driver-common.inc 64SECURITY_LDFLAGS_pn-xserver-xorg = "${SECURITY_X_LDFLAGS}" 65 66TARGET_CC_ARCH_append_pn-binutils = " ${SELECTED_OPTIMIZATION}" 67TARGET_CC_ARCH_append_pn-gcc = " ${SELECTED_OPTIMIZATION}" 68TARGET_CC_ARCH_append_pn-gdb = " ${SELECTED_OPTIMIZATION}" 69TARGET_CC_ARCH_append_pn-perf = " ${SELECTED_OPTIMIZATION}" 70