aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJulien Dusser <julien.dusser@free.fr>2018-01-07 17:41:35 +0100
committerHauke Mehrtens <hauke@hauke-m.de>2018-01-27 19:02:47 +0100
commit55779569eb817361222d653accd929a752b8327d (patch)
tree7a9bf11f138f57a0303eda7bee72f5e3233487f3
parentdf0bd42fdeb76c9bc51b816c3df699db123c0024 (diff)
downloadupstream-55779569eb817361222d653accd929a752b8327d.tar.gz
upstream-55779569eb817361222d653accd929a752b8327d.tar.bz2
upstream-55779569eb817361222d653accd929a752b8327d.zip
toolchain: add gcc configure default PIE and SSP
GCC supports starting version 5 --enable-default-ssp and starting version 6 --enable-default-pie. It produces hardened binaries by default without dealing with package compilation flags. Signed-off-by: Julien Dusser <julien.dusser@free.fr>
-rw-r--r--toolchain/gcc/Config.in15
-rw-r--r--toolchain/gcc/common.mk10
2 files changed, 25 insertions, 0 deletions
diff --git a/toolchain/gcc/Config.in b/toolchain/gcc/Config.in
index 06e9f487b9..0fe0ea2957 100644
--- a/toolchain/gcc/Config.in
+++ b/toolchain/gcc/Config.in
@@ -37,6 +37,21 @@ config EXTRA_GCC_CONFIG_OPTIONS
help
Any additional gcc options you may want to include....
+config GCC_DEFAULT_PIE
+ bool
+ prompt "Build executable with PIE enabled by default" if TOOLCHAINOPTS
+ depends on !GCC_USE_VERSION_5
+ default n
+ help
+ Use gcc configure option --enable-default-pie to turn on -fPIE and -pie by default.
+
+config GCC_DEFAULT_SSP
+ bool
+ prompt "Build executable with Stack-Smashing Protection enabled by default" if TOOLCHAINOPTS
+ default n
+ help
+ Use gcc configure option --enable-default-ssp to turn on -fstack-protector-strong by default.
+
config SSP_SUPPORT
bool
prompt "Enable Stack-Smashing Protection support" if TOOLCHAINOPTS
diff --git a/toolchain/gcc/common.mk b/toolchain/gcc/common.mk
index 7c4e773a0f..ece71ef028 100644
--- a/toolchain/gcc/common.mk
+++ b/toolchain/gcc/common.mk
@@ -133,6 +133,16 @@ ifndef GCC_VERSION_4_8
GCC_CONFIGURE += --with-diagnostics-color=auto-if-env
endif
+ifneq ($(CONFIG_GCC_DEFAULT_PIE),)
+ GCC_CONFIGURE+= \
+ --enable-default-pie
+endif
+
+ifneq ($(CONFIG_GCC_DEFAULT_SSP),)
+ GCC_CONFIGURE+= \
+ --enable-default-ssp
+endif
+
ifneq ($(CONFIG_SSP_SUPPORT),)
GCC_CONFIGURE+= \
--enable-libssp