From df0bd42fdeb76c9bc51b816c3df699db123c0024 Mon Sep 17 00:00:00 2001 From: Julien Dusser Date: Mon, 8 Jan 2018 23:47:06 +0100 Subject: build: add hardened builds with PIE (ASLR) support Introduce a configuration option to build a "hardened" OpenWrt with ASLR PIE support. Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR) by building Position Independent Executables (PIE). This new option protects against "return-to-text" attacks. Busybox need a special care, link is done with ld, not gcc, leading to unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE. If other failing packages were found, PKG_ASLR_PIE:=0 should be added to their Makefiles. Original Work by: Yongkui Han Signed-off-by: Julien Dusser --- package/utils/busybox/Makefile | 3 +++ 1 file changed, 3 insertions(+) (limited to 'package/utils/busybox') diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile index 8866756aea..4f85cc9614 100644 --- a/package/utils/busybox/Makefile +++ b/package/utils/busybox/Makefile @@ -22,6 +22,9 @@ PKG_BUILD_PARALLEL:=1 PKG_CHECK_FORMAT_SECURITY:=0 PKG_INSTALL:=1 +#Busybox use it's own PIE config flag and LDFLAGS are used with ld, not gcc. +PKG_ASLR_PIE:=0 + PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=LICENSE archival/libarchive/bz/LICENSE PKG_CPE_ID:=cpe:/a:busybox:busybox -- cgit v1.2.3