aboutsummaryrefslogtreecommitdiffstats
path: root/meta/conf/distro/include/security_flags.inc
AgeCommit message (Collapse)Author
2017-02-20security_flags.inc: let gettext be securerbt/gettextRobert Yang
It has been fixed. [YOCTO #9544] Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2017-02-15security_flags: disable -pie for gpgmeRoss Burton
Otherwise this fails to build the libraries: relocation R_X86_64_PC32 against undefined hidden symbol `__init_array_start' can not be used when making a shared object Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-02-15security_flags: enable string formatting check for console toolsChen Qi
As we've fixed the string formatting issue in console-tools, we don't need to override SECURITY_STRINGFORMAT for console-tools any more. [YOCTO #9540] Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-10-07security_flags: Diable PIE for mesa-glKhem Raj
This creeped in along with rest of the changes in c999b3d88dfcffbe0fb66406fb0bff1fb66f34bc even after it was reported a build failure in mesa-gl This is also showing up on arm architecture now | /usr/src/debug/glibc/2.24-r0/git/csu/elf-init.c:87: undefined reference to `__init_array_end' | /usr/src/debug/glibc/2.24-r0/git/csu/elf-init.c:87: undefined reference to `__init_array_start' | /a/builder/mnt/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/arm-oe-linux-gnueabi/gcc/arm-oe-linux-gnueabi/6.2.0/ld: .libs/mesa_dri_drivers.so: hidden symbol `__init_array_end' isn't defined Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-09source-highlight: add a recipeAlexander Kanavin
gtk-doc relies on this to highlight source code snippets Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
2016-08-17security_flags.inc: enable PIE for a few recipesAlexander Kanavin
They used to fail with PIE enabled, but no longer do. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-25slang: 2.2.4 -> 2.3.0Robert Yang
* Removed: change-char-type-to-signed-char-in-macros.patch sprintf-bug-concerning-8-bit-characters.patch They are already in the source. * Updated: fix-check-pcre.patch fix-check-pcre.patch slang-fix-the-iconv-existence-checking.patch * Use SECURITY_NO_PIE_CFLAGS for SECURITY_CFLAGS, it can't be built with "-pie -fpie": tmp/sysroots/qemux86-64/usr/lib64/../lib64/Scrt1.o: In function `_start': /usr/src/debug/glibc/2.24-r0/git/csu/../sysdeps/x86_64/start.S:104: undefined reference to `main' /tmp/ccMFTA8A.o: In function `smg_char_at': /usr/src/debug/slang/2.3.0-r0/slang-2.3.0/modules/slsmg-module.c:134: undefined reference to `SLsmg_char_at' /tmp/ccMFTA8A.o: In function `smg_resume_smg': Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-23security_flags.inc: add python3-pycairo and libnewt-python to no-pie ↵Alexander Kanavin
exception list Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-23security_flags.inc: add SECURITY_NO_PIE_CFLAGS to libgcc and gcc-sanitizersAlexander Kanavin
These recipes no longer seem to need full exclusion from security hardening. The rest (glibc, gcc-runtime, valgrind, grub, grub-efi, uclibc) still do. [YOCTO #9489] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-03security_flags.inc: add an entry for python3-numpyAlexander Kanavin
The entry is same as for python-numpy and prevents build failures when extra security flags are in use (e.g. in poky-lsb). Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-02python-imaging: remove unused recipeAlexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-01unzip: fix security issuesEdwin Plauchu
This patch avoids unzip fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9551] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19makedevs: fix security issuesEdwin Plauchu
This avoids makedevs failure to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9549] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19zip: fix security issuesEdwin Plauchu
This patch avoids zip recipe fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9552] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19stat: fix security issuesEdwin Plauchu
This patch avoids stat fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9550] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-15security_flags: Enable security flags on leafpad, ltp and libuser.Aníbal Limón
Now we have patches that solves the security formatting issues into those packages. Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-06security_flags: turn potential string format security issues into an errorJoshua Lock
Add "-Wformat -Wformat-security -Werror=format-security" to the default SECURITY_CFLAGS to catch potential security vulnerabilities due to the misuse of various string formatting functions. These flags are widely used in distributions such as Fedora and Ubuntu, however we have 15 recipes in OE-Core which fail to build with these flags included and thus the flags are removed for: - busybox - console-tools - cmake - expect - gcc - gettext - kexec-tools - leafpad - libuser - ltp - makedevs - oh-puzzles - stat - unzip - zip [YOCTO #9488] Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-09security_flags.inc: Special flags are needed for RPMMark Hatle
RPM interally has support to build and work with the stack protector. This is disabled by default in the RPM package, and the proper settings should be specified in the security_flags. Using the default setting of stack-protector-strong causes linking problems due to issues with libtool selecting the wrong GCC objections to link against. Falling back to the RPM values of stack-protector will permit linking to work properly, and some level of protection. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
2016-02-22security_flags: Disable ssp when compiling uclibcKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-15security_flags: Add SECURITY_CFLAGS to TARGET_CC_ARCH for binutilsKhem Raj
libtool decides to filter out -fstack-protector-strong on its own and its documented here https://www.gnu.org/software/libtool/manual/html_node/Stripped-link-flags.html this causes linking errors when linking libbfd.so since objects (.o) are compiled using -fstack-protector-strong so they are expecting to link with libssp but the option goes missing in linker flags. With this patch the security flags are hoisted upto CC itself and libtool thankfully does not touch CC. Adding to CC also means that we can now remove it from LDFLAGS since when gcc driver is used to do linking then we have LD = CC and this option makes to linker cmdline Since CC is used without CFLAGS in configure tests, some tests fail complaining that -Olevel is not used while using _FORTIFY_SOURCE therefore added SELECTED_OPTIMIZATION to TARGET_CC_ARCH as well Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07security_flags: wipe security flags for gcc/glibc and related librariesKhem Raj
It causes a catch-22 situation where we build libssp in gcc-runtime but also pass -fstack-protector flags which require libssp Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-07security_flags: use -fstack-protector-strongKhem Raj
This is a better version of -fstack-protector-all with reduced stack usage and better performance yet giving same amount of coverage. It's available in gcc 4.9 onwards. https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/ has more details. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-07security_flags: ensure security flags only apply to target buildsKhem Raj
As otherwise the security flags can leak into target builds. This can result in flags that the host compiler doesn't support, causing build failures. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-07security_flags.inc: don't do -pie for syslinuxRoss Burton
sysroots/x86_64-linux/usr/libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/5.3.0/ld: syslinux.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-19security_flags.inc: remove obsolete workarounds for curlAndre McCurdy
The curl configure script contains sanity checks for unexpected options being passed via CFLAGS, LDFLAGS, etc. environment variables. These sanity checks catch -Dxxx options in CFLAGS, which clashes with OE's approach of using CFLAGS to pass -D_FORTIFY_SOURCE (curl's configure script suggests, quite correctly, that -Dxxx options should be passed via CPPFLAGS instead). These sanity checks previously generated fatal errors, but have been downgraded to warnings since curl v7.32. Therefore the workaround of avoiding -D_FORTIFY_SOURCE for curl is obsolete and can be removed. https://github.com/bagder/curl/commit/5d3cbde72ece7d83c280492957a26e26ab4e5cca Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-07security_flags.inc: disable -fstack-protector-XXX for valgrindAndre McCurdy
Valgrind (v3.11.0) expects to build with stack protection disabled and includes -fno-stack-protector in its default CFLAGS. However, the CFLAGS provided by OE are included on the compiler command line after the defaults so any -fstack-protector-all / -fstack-protector-strong option provided by security_flags.inc will cause problems. | .../build-bcm97425vms/tmp/work/mips32el-rdk-linux/valgrind/3.11.0-r0/valgrind-3.11.0/coregrind/m_mallocfree.c:892: undefined reference to `__stack_chk_guard' | .../build-bcm97425vms/tmp/work/mips32el-rdk-linux/valgrind/3.11.0-r0/valgrind-3.11.0/coregrind/m_mallocfree.c:947: undefined reference to `__stack_chk_fail' Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-09-14webkit-gtk: remove the recipe for the obsolete version 1.8.3Alexander Kanavin
webkitgtk 2.8.3 is provided instead and midori browser is replaced by epiphany in separate commits. (From OE-Core rev: 1a72dc9c44c7806c869c3b3afcd5d31bcf2da979) Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-08-09security_flags.inc: disable -pie and -fpie from Python3 compilation.Topi Kuutela
If security_flags.inc is 'required' to the image, -pie and -fpie options are added to CFLAGS. These are not compatible with -shared GCC option. The result is several errors of following form and missing Python3 modules in the image: *.o In function `_start': *.S undefined reference to `main' collect2: error: ld returned 1 exit status Signed-off-by: Topi Kuutela <topi.kuutela@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-27security-flags: Disable PIE for coreutils, elfutils, gcc, iptablesRichard Purdie
With gcc 5, we need to disable the PIE flags for more recipes in order to have successful builds. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-07security_flags: eliminate FORTIFY_SOURCE for debug buildsJoe Slater
If -D_FORTIFY_SOURCE=2 is included in CFLAGS for debug builds, many warnings will be generated and some packages will fail to build. So, only conditionally include it. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-06-23security_flags.inc: remove duplicated over-ridesAndre McCurdy
The following over-rides were both defined twice: SECURITY_CFLAGS_pn-grub-efi-x86-64-native SECURITY_CFLAGS_pn-ltp Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-30security_flags: Add comment about what it does and who uses itRichard Purdie
It was pointed out that people couldn't easily see who used this or why so add some comments about that. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-03security_flags: Add python-numpy to pie incompatible listRichard Purdie
With poky-lsb (security flags enabled), python-numpy doesn't build with pie flags. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-08security_flags.inc: elfutils on ARM fails with PIE flagsDenys Dmytriyenko
The error messages look like this: R_ARM_TLS_LE32 relocation not permitted in shared object Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-02security_flags: remove PIE flags from flex and gstreamer1.0-plugins-badRoss Burton
These recipes both fail to build with "relocation R_X86_64_PC32 against undefined hidden symbol `__init_array_start' can not be used when making a shared object" when using PIE. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-01-29security_flags: disable PIE on expectRoss Burton
Disable PIE in expect as otherwise it tries to link the shared library as an executable. Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-01-23gcc-sanitizers: Enable GCC sanitizersDan McGregor
AddressSanitizer is a fast memory error detector. ThreadSanitizer detects data races. UBSanitizer detectes undefined behaviour. All consist of compiler instrumentation and a run-time library. The compiler instrumentation was already enabled, this builds the run-time library component. Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
2015-01-16security_flags: disable pie support for libaio, blktrace and ltpSaul Wold
libaio when built with pie and fpie does not link correctly with blktrace or ltp so we need to disable those flags until a better solution comes along. Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-12-19security_flags: Fix typo for cupsRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-09-01distro: TCLIBC now defines glibc instead of eglibcKhem Raj
Adjust naming conventions to reflect eglibc->glibc move Signed-off-by: Khem Raj <raj.khem@gmail.com>
2014-03-05security_flags: Update to correctly link X modulesSaul Wold
Remove the -z,now flag from linking [YOCTO #5885] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-26security-flags: Avoid lttng-tools issue on armRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-26security-flags: Deal with powerpc build issuesRichard Purdie
Building powerpc machines with the standard security flags generated numerous build failures. Use a reduced set of flags for now to avoid linker issues and other compile failures. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-26security_flags: disable PIE flags for cups buildsSaul Wold
Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-14security_flags: db can't use pie flags from gcc for security buildSaul Wold
[YOCTO #5721] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-06security_flags: add the rest of the grub-efi related packagesSaul Wold
[YOCTO #5515] Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-12-18security_flags: more relocation issuesSaul Wold
These are similar relocation R_X86_64_PC32 issues that are solved by removing the -pie flags. [YOCTO #5515] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-12-04security_flags: Add entry for opensslSaul Wold
It seems we might be stumbling over an obscure linkage issues possibly similar to http://marc.info/?l=openssl-dev&m=130132183118768&w=2 This issue appears for x86-64 systems with the PIE related compiler flags. libcrypto.a(cryptlib.o): relocation R_X86_64_PC32 against symbol `OPENSSL_showfatal' can not be used when making a shared object; recompile with -fPIC The error suggests recompiling with -fPIC, but it is already compiled that way. Disable the PIE flags makes it work for now, I have posted to openssl ML [YOCTO #5515] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-11-22security_flags: grub-efi-natve does not build with flags enabledSaul Wold
[YOCTO #5505] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-09-17mesa-gl: add GL-only Mesa recipeRoss Burton
Some machines have hardware-specific GL drivers that do EGL and GLES (many ARM boards). Others have their own EGL/GLES drivers and provide a Mesa DRI driver (EMGD). Previously adding Mesa, for software GL/GLX rendering in the first case and hardware GLX in the second, involved bbappends and changing Mesa to be machine-specific. By adding a just-GL Mesa the machine definition can combine it with the hardware drivers cleanly. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-02 07:04:04 +0000