298977887/lede
1
0
Fork 0
mirror of https://github.com/coolsnowwolf/lede.git synced 2025-04-16 04:13:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

buildsystem: Make PIE ASLR option tristate

Browse Source
This commit is contained in:
LEAN-ESX 2020-01-17 10:55:30 -08:00
parent 77ab08c20c
commit 6c5dcf4fb8
2 changed files with 26 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
config/Config-build.in
View File

@ -191,11 +191,10 @@ menu "Global build settings"
this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
Makefile.
config PKG_ASLR_PIE
bool
choice
prompt "User space ASLR PIE compilation"
select BUSYBOX_DEFAULT_PIE
default n
default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK)
default PKG_ASLR_PIE_REGULAR
help
Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
This enables package build as Position Independent Executables (PIE)
@ -206,6 +205,21 @@ menu "Global build settings"
to predict when an attacker is attempting a memory-corruption exploit.
You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
Makefile.
Be ware that ASLR increases the binary size.
config PKG_ASLR_PIE_NONE
bool "None"
help
PIE is deactivated for all applications
config PKG_ASLR_PIE_REGULAR
bool "Regular"
help
PIE is activated for some binaries, mostly network exposed applications
config PKG_ASLR_PIE_ALL
bool "All"
select BUSYBOX_DEFAULT_PIE
help
PIE is activated for all applications
endchoice
choice
prompt "User space Stack-Smashing Protection"

9
include/hardening.mk
View File

@ -7,6 +7,7 @@
PKG_CHECK_FORMAT_SECURITY ?= 1
PKG_ASLR_PIE ?= 1
PKG_ASLR_PIE_REGULAR ?= 0
PKG_SSP ?= 1
PKG_FORTIFY_SOURCE ?= 1
PKG_RELRO ?= 1
@ -16,12 +17,18 @@ ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
TARGET_CFLAGS += -Wformat -Werror=format-security
endif
endif
ifdef CONFIG_PKG_ASLR_PIE
ifdef CONFIG_PKG_ASLR_PIE_ALL
ifeq ($(strip $(PKG_ASLR_PIE)),1)
TARGET_CFLAGS += $(FPIC)
TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
endif
endif
ifdef CONFIG_PKG_ASLR_PIE_REGULAR
ifeq ($(strip $(PKG_ASLR_PIE_REGULAR)),1)
TARGET_CFLAGS += $(FPIC)
TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
endif
endif
ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR
ifeq ($(strip $(PKG_SSP)),1)
TARGET_CFLAGS += -fstack-protector