mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2024-06-16 04:03:56 +02:00
19cbac7d26
This tristate choose allows to select to build only some applications with PIE enabled. On MIPS binaries are getting about 30% bigger when PIE is activated for the, which is a huge increase. Network exposed applications like dnsmasq should then be build with PIE enabled, but some applications which are normally not parsing data from the network do not have it activated. The regular option should give a good trade off between extra flash and RAM memory usage and security. This changes the default from building no applications with PIE to build some specifically marked applications with PIE enabled. This option is only activated for targets with bigger flash and RAM to not consume extra memory on the very small targets. On SDK builds the Regular option should always be selected, because some tiny targets share the applications with big targets and only the images for the tiny targets should contain the none PIE applications, but the images for the normal targets should use PIE. The shared packages should always use PIE when it should be normally activated. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: Petr Štetiar <ynezz@true.cz>
65 lines
1.6 KiB
Makefile
65 lines
1.6 KiB
Makefile
#
|
|
# Copyright (C) 2015 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
PKG_CHECK_FORMAT_SECURITY ?= 1
|
|
PKG_ASLR_PIE ?= 1
|
|
PKG_ASLR_PIE_REGULAR ?= 0
|
|
PKG_SSP ?= 1
|
|
PKG_FORTIFY_SOURCE ?= 1
|
|
PKG_RELRO ?= 1
|
|
|
|
ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
|
|
ifeq ($(strip $(PKG_CHECK_FORMAT_SECURITY)),1)
|
|
TARGET_CFLAGS += -Wformat -Werror=format-security
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_ASLR_PIE_ALL
|
|
ifeq ($(strip $(PKG_ASLR_PIE)),1)
|
|
TARGET_CFLAGS += $(FPIC)
|
|
TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_ASLR_PIE_REGULAR
|
|
ifeq ($(strip $(PKG_ASLR_PIE_REGULAR)),1)
|
|
TARGET_CFLAGS += $(FPIC)
|
|
TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR
|
|
ifeq ($(strip $(PKG_SSP)),1)
|
|
TARGET_CFLAGS += -fstack-protector
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_CC_STACKPROTECTOR_STRONG
|
|
ifeq ($(strip $(PKG_SSP)),1)
|
|
TARGET_CFLAGS += -fstack-protector-strong
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_FORTIFY_SOURCE_1
|
|
ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
|
|
TARGET_CFLAGS += -D_FORTIFY_SOURCE=1
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_FORTIFY_SOURCE_2
|
|
ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
|
|
TARGET_CFLAGS += -D_FORTIFY_SOURCE=2
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_RELRO_PARTIAL
|
|
ifeq ($(strip $(PKG_RELRO)),1)
|
|
TARGET_CFLAGS += -Wl,-z,relro
|
|
TARGET_LDFLAGS += -zrelro
|
|
endif
|
|
endif
|
|
ifdef CONFIG_PKG_RELRO_FULL
|
|
ifeq ($(strip $(PKG_RELRO)),1)
|
|
TARGET_CFLAGS += -Wl,-z,now -Wl,-z,relro
|
|
TARGET_LDFLAGS += -znow -zrelro
|
|
endif
|
|
endif
|
|
|