From 55779569eb817361222d653accd929a752b8327d Mon Sep 17 00:00:00 2001 From: Julien Dusser Date: Sun, 7 Jan 2018 17:41:35 +0100 Subject: toolchain: add gcc configure default PIE and SSP GCC supports starting version 5 --enable-default-ssp and starting version 6 --enable-default-pie. It produces hardened binaries by default without dealing with package compilation flags. Signed-off-by: Julien Dusser --- toolchain/gcc/Config.in | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'toolchain/gcc/Config.in') diff --git a/toolchain/gcc/Config.in b/toolchain/gcc/Config.in index 06e9f487b9..0fe0ea2957 100644 --- a/toolchain/gcc/Config.in +++ b/toolchain/gcc/Config.in @@ -37,6 +37,21 @@ config EXTRA_GCC_CONFIG_OPTIONS help Any additional gcc options you may want to include.... +config GCC_DEFAULT_PIE + bool + prompt "Build executable with PIE enabled by default" if TOOLCHAINOPTS + depends on !GCC_USE_VERSION_5 + default n + help + Use gcc configure option --enable-default-pie to turn on -fPIE and -pie by default. + +config GCC_DEFAULT_SSP + bool + prompt "Build executable with Stack-Smashing Protection enabled by default" if TOOLCHAINOPTS + default n + help + Use gcc configure option --enable-default-ssp to turn on -fstack-protector-strong by default. + config SSP_SUPPORT bool prompt "Enable Stack-Smashing Protection support" if TOOLCHAINOPTS -- cgit v1.2.3