diff options
| author | Joe Slater <jslater@windriver.com> | 2015-07-02 17:10:51 +0800 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-07-07 23:57:13 +0100 |
| commit | 1b576012a6a2b2ebc2c507cdaebd62174810b191 (patch) | |
| tree | 69438e698a2b5f506a483b557928966140b0ed4e /meta/conf | |
| parent | 2cff20f423fb9e82b44c68504be605c223bd74fb (diff) | |
| download | openembedded-core-1b576012a6a2b2ebc2c507cdaebd62174810b191.tar.gz openembedded-core-1b576012a6a2b2ebc2c507cdaebd62174810b191.tar.bz2 openembedded-core-1b576012a6a2b2ebc2c507cdaebd62174810b191.zip | |
security_flags: eliminate FORTIFY_SOURCE for debug builds
If -D_FORTIFY_SOURCE=2 is included in CFLAGS for debug builds,
many warnings will be generated and some packages will fail to
build. So, only conditionally include it.
Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Diffstat (limited to 'meta/conf')
| -rw-r--r-- | meta/conf/distro/include/security_flags.inc | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index 104a6cbfea..85a3bfe589 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc @@ -5,13 +5,18 @@ # From a Yocto Project perspective, this file is included and tested # in the DISTRO="poky-lsb" configuration. -SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" -SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all -D_FORTIFY_SOURCE=2" +# _FORTIFY_SOURCE requires -O1 or higher, so disable in debug builds as they use +# -O0 which then results in a compiler warning. +lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" + +SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}" +SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}" + SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" # powerpc does not get on with pie for reasons not looked into as yet -SECURITY_CFLAGS_powerpc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}" # Deal with ppc specific linker failures when using the cflags SECURITY_CFLAGS_pn-dbus_powerpc = "" SECURITY_CFLAGS_pn-dbus-ptest_powerpc = "" |