summaryrefslogtreecommitdiffstats
path: root/meta/conf/distro/include/security_flags.inc
AgeCommit message (Collapse)Author
2020-03-24security_flags.inc: fix flags missing from SDK toolchainTom Hochstein
The security flags were missing from the SDK toolchain because they were added specifically to class-target. Add them to class-cross-canadian as well (since the SDK environment file is created from cross-canadian target flags). Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> Signed-off-by: Antoine Manache <a.manache@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-06security_flags.inc: Add overrides for glibc-testsuite to match glibcNathan Rossi
Ensure glibc-testsuite has the same flags as glibc. Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-06Clean up remnants of glibc-initialNathan Rossi
Remove remnants of the glibc-initial recipe. Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-30security_flags.inc: add var-SECURITY_STACK_PROTECTOR to improve variable ↵Hongxu Jia
OVERRIDES There are var-SECURITY_PIE_CFLAGS, var-lcl_maybe_fortify and var-SECURITY_STRINGFORMAT which are helpful for OVERRIDES. Also add var-SECURITY_STACK_PROTECTOR, and drop hardcoded `_remove' overrides. Such as `4ca946c security_flags: use -fstack-protector-strong', it s/-fstack-protector-all/-fstack-protector-strong/, only tweak var-SECURITY_STACK_PROTECTOR is sufficient. The fix does not have any side affect on SECURITY_CFLAGS of glibc/ glibc-initial/gcc-runtime, these three directly assigned with "". ... SECURITY_CFLAGS_pn-glibc = "" SECURITY_CFLAGS_pn-glibc-initial = "" SECURITY_CFLAGS_pn-gcc-runtime = "" ... Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-30security_flags.inc: use `?=' to set a default var-lcl_maybe_fortifyHongxu Jia
- Since poky enable security flags+pie by default, tweak comments to sync with it. [poky commit] 491082c poky.conf: Enable security flags+pie by default 29d76b3 poky-lsb: Remove including security_flags.inc [poky commit] - Use `?=' to set a default lcl_maybe_fortify, it is helpful for variable OVERRIDES. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20powerpc: Remove pie flags from compiler cmdlineKhem Raj
Original approach to add -no-<pie> flags cause link time behavior changes where packages start to lose the -fPIC -DPIC in compiler cmdline and this list keeps growing as we build more and more packages, Instead lets just remove the options we dont need from SECURITY_CFLAGS this makes it more robust and less intrusive This also means we do not need to re-add pic options as we started to do for affected packages Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15security_flags: Add PIC to cflags for some recipes on ppcKhem Raj
Fixes issues related out of range R_PPC_REL24 e.g. /usr/lib/xorg/modules/input/libinput_drv.so: /usr/lib/libinput.so.10: R_PPC_REL24 relocation at 0x0e8602c4 for symbol `libevdev_has_event_code' out of range Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-05-15security_flags.inc: drop obsolete commentAndre McCurdy
The last ARM specific over-ride was removed in: http://git.openembedded.org/openembedded-core/commit/?id=e93765ffb5718b0fce84f0b8123963176dea95e4 but the comment was accidentally left behind. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-05-14security_flags: disable static PIE in glibcRoss Burton
Static PIE doesn't work entirely right in GCC 7, for example ldconfig on ARM with the flags enabled will something segfault during initialisation. To mitigate this until we have GCC 8 integrated, don't enable static PIE. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-03-01glibc: Enable static PIE support when security_flags are enabledKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-02-06security_flags.inc, xorg-driver-common.inc: Move SECURITY_X_LDFLAGS logicTom Rini
We need to ensure that all xorg modules are linked with SECURITY_X_LDFLAGS to ensure that they will be able to resolve their run time dependencies. The approach of listing each driver in security_flags.inc lets less frequently used drivers be run-time broken. Move the flag logic into xorg-driver-common.inc so that all xorg modules from all layers will have the correct security flags used. Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-01-29meta: don't use deprecated functions from utils.bbclassRoss Burton
These functions were moved to meta/lib/oe in 2010 and the base_* functions in utils.bbclass were intended to be a short-term compatibility layer. They're still used in a few places, so update the callers to use the new functions. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-07-08security_flags.inc: Do not build gcc for powerpc with PIE defaultsKhem Raj
Since we have disabled FPIE from SECURITY_CFLAGS already, we have to ensure the same with gcc, otherwise gcc (on-device) will be built defaulting to PIE, and such binaries will fail to execute Signed-off-by: Khem Raj <raj.khem@gmail.com>
2017-07-08security_flags.inc: Delete pinnings for SECURITY_NO_PIE_CFLAGSKhem Raj
GCC is configured correctly to pass PIE cflags/ldflags Signed-off-by: Khem Raj <raj.khem@gmail.com>
2017-07-08gcc: Introduce a knob to configure gcc to default to PIEKhem Raj
GCCPIE flag which is empty by default adds "--enable-default-pie" configure option for harderned distros We do not require to add -fpie -pie flag externally anymore Signed-off-by: Khem Raj <raj.khem@gmail.com>
2017-06-16meta: Drop remnants of uclibc supportRichard Purdie
uclibc support was removed a while ago and musl works much better. Start to remove the various overrides and patches related to uclibc which are no longer needed. uclibc support in a layer would still be possible. I have strong reasons to believe nobody is still using uclibc since patches are missing and I doubt the metadata even parses anymore. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-04-08python-pycurl: create python3-pycurl recipeDmitry Rozhkov
The python-pycurl recipe can be used with python2 only even though python3 is officially supported by upstream. Create python3-pycurl recipe enabling the pycurl module for python3. Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-28dnf: move the entire dnf/rpm4 stack to Python 3Alexander Kanavin
[YOCTO #11180] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-23expect: resolve string formatting issuesAlexander Kanavin
[YOCTO #9542] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-17kexec-tools: Add patches to enable format-securityJussi Kukkonen
Also remove the override from security_flags.inc Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-17cmake: Backport fix to enable -Wformat-securityJussi Kukkonen
Backport build fix that removes -Wformat-security for specific tests. Enable "-Wformat-security" for cmake in security_flags.inc. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-13security_flags.inc: update to reflect smart->dnf transitionAlexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
2017-03-11security_flags.inc: Update for new python modulesAlexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-23security_flags.inc: let gettext be secureRobert Yang
It has been fixed. [YOCTO #9544] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-02-15security_flags: disable -pie for gpgmeRoss Burton
Otherwise this fails to build the libraries: relocation R_X86_64_PC32 against undefined hidden symbol `__init_array_start' can not be used when making a shared object Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-02-15security_flags: enable string formatting check for console toolsChen Qi
As we've fixed the string formatting issue in console-tools, we don't need to override SECURITY_STRINGFORMAT for console-tools any more. [YOCTO #9540] Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-10-07security_flags: Diable PIE for mesa-glKhem Raj
This creeped in along with rest of the changes in c999b3d88dfcffbe0fb66406fb0bff1fb66f34bc even after it was reported a build failure in mesa-gl This is also showing up on arm architecture now | /usr/src/debug/glibc/2.24-r0/git/csu/elf-init.c:87: undefined reference to `__init_array_end' | /usr/src/debug/glibc/2.24-r0/git/csu/elf-init.c:87: undefined reference to `__init_array_start' | /a/builder/mnt/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/arm-oe-linux-gnueabi/gcc/arm-oe-linux-gnueabi/6.2.0/ld: .libs/mesa_dri_drivers.so: hidden symbol `__init_array_end' isn't defined Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-09source-highlight: add a recipeAlexander Kanavin
gtk-doc relies on this to highlight source code snippets Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
2016-08-17security_flags.inc: enable PIE for a few recipesAlexander Kanavin
They used to fail with PIE enabled, but no longer do. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-25slang: 2.2.4 -> 2.3.0Robert Yang
* Removed: change-char-type-to-signed-char-in-macros.patch sprintf-bug-concerning-8-bit-characters.patch They are already in the source. * Updated: fix-check-pcre.patch fix-check-pcre.patch slang-fix-the-iconv-existence-checking.patch * Use SECURITY_NO_PIE_CFLAGS for SECURITY_CFLAGS, it can't be built with "-pie -fpie": tmp/sysroots/qemux86-64/usr/lib64/../lib64/Scrt1.o: In function `_start': /usr/src/debug/glibc/2.24-r0/git/csu/../sysdeps/x86_64/start.S:104: undefined reference to `main' /tmp/ccMFTA8A.o: In function `smg_char_at': /usr/src/debug/slang/2.3.0-r0/slang-2.3.0/modules/slsmg-module.c:134: undefined reference to `SLsmg_char_at' /tmp/ccMFTA8A.o: In function `smg_resume_smg': Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-23security_flags.inc: add python3-pycairo and libnewt-python to no-pie ↵Alexander Kanavin
exception list Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-23security_flags.inc: add SECURITY_NO_PIE_CFLAGS to libgcc and gcc-sanitizersAlexander Kanavin
These recipes no longer seem to need full exclusion from security hardening. The rest (glibc, gcc-runtime, valgrind, grub, grub-efi, uclibc) still do. [YOCTO #9489] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-03security_flags.inc: add an entry for python3-numpyAlexander Kanavin
The entry is same as for python-numpy and prevents build failures when extra security flags are in use (e.g. in poky-lsb). Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-02python-imaging: remove unused recipeAlexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-01unzip: fix security issuesEdwin Plauchu
This patch avoids unzip fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9551] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19makedevs: fix security issuesEdwin Plauchu
This avoids makedevs failure to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9549] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19zip: fix security issuesEdwin Plauchu
This patch avoids zip recipe fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9552] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19stat: fix security issuesEdwin Plauchu
This patch avoids stat fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9550] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-15security_flags: Enable security flags on leafpad, ltp and libuser.Aníbal Limón
Now we have patches that solves the security formatting issues into those packages. Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-06security_flags: turn potential string format security issues into an errorJoshua Lock
Add "-Wformat -Wformat-security -Werror=format-security" to the default SECURITY_CFLAGS to catch potential security vulnerabilities due to the misuse of various string formatting functions. These flags are widely used in distributions such as Fedora and Ubuntu, however we have 15 recipes in OE-Core which fail to build with these flags included and thus the flags are removed for: - busybox - console-tools - cmake - expect - gcc - gettext - kexec-tools - leafpad - libuser - ltp - makedevs - oh-puzzles - stat - unzip - zip [YOCTO #9488] Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-09security_flags.inc: Special flags are needed for RPMMark Hatle
RPM interally has support to build and work with the stack protector. This is disabled by default in the RPM package, and the proper settings should be specified in the security_flags. Using the default setting of stack-protector-strong causes linking problems due to issues with libtool selecting the wrong GCC objections to link against. Falling back to the RPM values of stack-protector will permit linking to work properly, and some level of protection. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
2016-02-22security_flags: Disable ssp when compiling uclibcKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-15security_flags: Add SECURITY_CFLAGS to TARGET_CC_ARCH for binutilsKhem Raj
libtool decides to filter out -fstack-protector-strong on its own and its documented here https://www.gnu.org/software/libtool/manual/html_node/Stripped-link-flags.html this causes linking errors when linking libbfd.so since objects (.o) are compiled using -fstack-protector-strong so they are expecting to link with libssp but the option goes missing in linker flags. With this patch the security flags are hoisted upto CC itself and libtool thankfully does not touch CC. Adding to CC also means that we can now remove it from LDFLAGS since when gcc driver is used to do linking then we have LD = CC and this option makes to linker cmdline Since CC is used without CFLAGS in configure tests, some tests fail complaining that -Olevel is not used while using _FORTIFY_SOURCE therefore added SELECTED_OPTIMIZATION to TARGET_CC_ARCH as well Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07security_flags: wipe security flags for gcc/glibc and related librariesKhem Raj
It causes a catch-22 situation where we build libssp in gcc-runtime but also pass -fstack-protector flags which require libssp Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-07security_flags: use -fstack-protector-strongKhem Raj
This is a better version of -fstack-protector-all with reduced stack usage and better performance yet giving same amount of coverage. It's available in gcc 4.9 onwards. https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/ has more details. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-07security_flags: ensure security flags only apply to target buildsKhem Raj
As otherwise the security flags can leak into target builds. This can result in flags that the host compiler doesn't support, causing build failures. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-07security_flags.inc: don't do -pie for syslinuxRoss Burton
sysroots/x86_64-linux/usr/libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/5.3.0/ld: syslinux.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-19security_flags.inc: remove obsolete workarounds for curlAndre McCurdy
The curl configure script contains sanity checks for unexpected options being passed via CFLAGS, LDFLAGS, etc. environment variables. These sanity checks catch -Dxxx options in CFLAGS, which clashes with OE's approach of using CFLAGS to pass -D_FORTIFY_SOURCE (curl's configure script suggests, quite correctly, that -Dxxx options should be passed via CPPFLAGS instead). These sanity checks previously generated fatal errors, but have been downgraded to warnings since curl v7.32. Therefore the workaround of avoiding -D_FORTIFY_SOURCE for curl is obsolete and can be removed. https://github.com/bagder/curl/commit/5d3cbde72ece7d83c280492957a26e26ab4e5cca Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-07security_flags.inc: disable -fstack-protector-XXX for valgrindAndre McCurdy
Valgrind (v3.11.0) expects to build with stack protection disabled and includes -fno-stack-protector in its default CFLAGS. However, the CFLAGS provided by OE are included on the compiler command line after the defaults so any -fstack-protector-all / -fstack-protector-strong option provided by security_flags.inc will cause problems. | .../build-bcm97425vms/tmp/work/mips32el-rdk-linux/valgrind/3.11.0-r0/valgrind-3.11.0/coregrind/m_mallocfree.c:892: undefined reference to `__stack_chk_guard' | .../build-bcm97425vms/tmp/work/mips32el-rdk-linux/valgrind/3.11.0-r0/valgrind-3.11.0/coregrind/m_mallocfree.c:947: undefined reference to `__stack_chk_fail' Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-09-14webkit-gtk: remove the recipe for the obsolete version 1.8.3Alexander Kanavin
webkitgtk 2.8.3 is provided instead and midori browser is replaced by epiphany in separate commits. (From OE-Core rev: 1a72dc9c44c7806c869c3b3afcd5d31bcf2da979) Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-28 05:07:05 +0000