Commit graph

6 commits

Author SHA1 Message Date
Julien Dusser
4dfa6b7a30 build: fix ASLR for LTO packages
Fix building packages with LTO when CONFIG_PKG_ASLR_PIE is enabled.

Despite comment of PR lto/80838, it seems that GCC needs -fPIC on linker
command line, even if all objects are -fPIC. This may change as PR
lto/80838 is merged into 8.1

compile-tested: ar71xx, ath79

Fix commits:
6dac92a42e
8c11133c9d
07940acc34
e7397eef69
ef16a394d2
ef96d1e34a
47b42137ce
73fc67b614
154c0c4006
804c51e1e6

Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2018-07-30 14:26:16 +02:00
Kevin Darbyshire-Bryant
89b59994eb build: ASLR hardening use $(FPIC)
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2018-07-03 14:19:10 +01:00
Julien Dusser
df0bd42fde build: add hardened builds with PIE (ASLR) support
Introduce a configuration option to build a "hardened" OpenWrt with
ASLR PIE support.

Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR)
by building Position Independent Executables (PIE). This new option protects
against "return-to-text" attacks.

Busybox need a special care, link is done with ld, not gcc, leading to
unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE.

If other failing packages were found, PKG_ASLR_PIE:=0 should be added to
their Makefiles.

Original Work by: Yongkui Han <yonhan@cisco.com>
Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2018-01-27 16:46:45 +01:00
Steven Barth
6010a1cdb7 hardening: make override variables more intuitive
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
Steven Barth
1877bc9d8f gcc/musl: rework SSP-support
Make musl provide libssp_nonshared.a and make GCC link it unconditionally
if musl is used. This should be a no-op if SSP is disabled and seems to be
the only reliable way of dealing with SSP over all packages due to the mess
that is linkerflags handling in packages.

Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 46108
2015-06-22 10:31:07 +00:00
Steven Barth
fc5f02410f buildroot: move hardening options into separate file
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 46070
2015-06-20 17:37:18 +00:00