diff options
| author | Julien Dusser <julien.dusser@free.fr> | 2018-01-08 23:47:06 +0100 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2018-01-27 16:46:45 +0100 |
| commit | df0bd42fdeb76c9bc51b816c3df699db123c0024 (patch) | |
| tree | 1057e289580397c014b2c9c4460057e9e7ac8367 /include/hardened-ld-pie.specs | |
| parent | ca7e8627dbbbcae0d1bfacea51d9b564617195de (diff) | |
| download | upstream-df0bd42fdeb76c9bc51b816c3df699db123c0024.tar.gz upstream-df0bd42fdeb76c9bc51b816c3df699db123c0024.tar.bz2 upstream-df0bd42fdeb76c9bc51b816c3df699db123c0024.zip | |
build: add hardened builds with PIE (ASLR) support
Introduce a configuration option to build a "hardened" OpenWrt with
ASLR PIE support.
Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR)
by building Position Independent Executables (PIE). This new option protects
against "return-to-text" attacks.
Busybox need a special care, link is done with ld, not gcc, leading to
unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE.
If other failing packages were found, PKG_ASLR_PIE:=0 should be added to
their Makefiles.
Original Work by: Yongkui Han <yonhan@cisco.com>
Signed-off-by: Julien Dusser <julien.dusser@free.fr>
Diffstat (limited to 'include/hardened-ld-pie.specs')
| -rw-r--r-- | include/hardened-ld-pie.specs | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/hardened-ld-pie.specs b/include/hardened-ld-pie.specs new file mode 100644 index 0000000000..7317b19a17 --- /dev/null +++ b/include/hardened-ld-pie.specs @@ -0,0 +1,2 @@ +*self_spec: ++ %{no-pie|static|r|shared:;:-pie} |