diff options
| author | Khem Raj <raj.khem@gmail.com> | 2016-02-05 16:52:41 +0000 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2016-02-07 17:29:44 +0000 |
| commit | 4ca946c029f04ba3991ed0f1f65355a7a7840ff4 (patch) | |
| tree | 51c4da95069a0ba8a6317b37c6efc87747851cbf /meta | |
| parent | ff2c8af73046f55aa733ce8289b6236c88300290 (diff) | |
| download | openembedded-core-4ca946c029f04ba3991ed0f1f65355a7a7840ff4.tar.gz openembedded-core-4ca946c029f04ba3991ed0f1f65355a7a7840ff4.tar.bz2 openembedded-core-4ca946c029f04ba3991ed0f1f65355a7a7840ff4.zip | |
security_flags: use -fstack-protector-strong
This is a better version of -fstack-protector-all with reduced stack usage and
better performance yet giving same amount of coverage. It's available in gcc
4.9 onwards.
https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/ has more
details.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Diffstat (limited to 'meta')
| -rw-r--r-- | meta/conf/distro/include/security_flags.inc | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index 72d31ba67b..5e0ef634bf 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc @@ -9,14 +9,14 @@ # -O0 which then results in a compiler warning. lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" -SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}" -SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}" +SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify}" +SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify}" -SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" -SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" +SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now" +SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro" # powerpc does not get on with pie for reasons not looked into as yet -SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}" +SECURITY_CFLAGS_powerpc = "-fstack-protector-strong ${lcl_maybe_fortify}" # Deal with ppc specific linker failures when using the cflags SECURITY_CFLAGS_pn-dbus_powerpc = "" SECURITY_CFLAGS_pn-dbus-ptest_powerpc = "" |