diff options
| author |   Khem Raj <raj.khem@gmail.com> | 2017-06-10 07:51:58 -0700 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-07-08 13:33:58 +0100 |
| commit | 1c7e195c94764d680a12a49b870f04cd58860f81 (patch) | |
| tree | ed5d1fd4c0e1f691feff0606b8a4c7d1a366e68a /meta/conf | |
| parent | 7267e7c000c76c44d09835d4cd2bc485b6a39a2a (diff) | |
| download | openembedded-core-contrib-1c7e195c94764d680a12a49b870f04cd58860f81.tar.gz | |
gcc: Introduce a knob to configure gcc to default to PIE
GCCPIE flag which is empty by default adds "--enable-default-pie"
configure option for harderned distros
We do not require to add -fpie -pie flag externally anymore
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Diffstat (limited to 'meta/conf')
| -rw-r--r-- | meta/conf/distro/include/security_flags.inc | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index 38164d08b8..f2eb224a77 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc @@ -5,6 +5,8 @@ # From a Yocto Project perspective, this file is included and tested # in the DISTRO="poky-lsb" configuration. +GCCPIE ?= "--enable-default-pie" + # _FORTIFY_SOURCE requires -O1 or higher, so disable in debug builds as they use # -O0 which then results in a compiler warning. lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" @@ -12,7 +14,7 @@ lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE # Error on use of format strings that represent possible security problems SECURITY_STRINGFORMAT ?= "-Wformat -Wformat-security -Werror=format-security" -SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}" +SECURITY_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}" SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify} ${SECURITY_STRINGFORMAT}" SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now" |