snailed
/
void-packages
2
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Activity
void-packages/common/environment/configure/hardening.sh

27 lines
988 B
Bash
Raw Normal View History

xbps-src: move compiler/linker defaults to env/hardening.sh. The user can still set his/her defaults via etc/conf, and per package in the templates.
2015-11-17 17:13:12 +01:00
# Enable SSP and FORITFY_SOURCE=2 by default.
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
_CFLAGS=" -fstack-protector-strong -D_FORTIFY_SOURCE=2 ${CFLAGS}"
_CXXFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 ${CXXFLAGS}"
xbps-src: move compiler/linker defaults to env/hardening.sh. The user can still set his/her defaults via etc/conf, and per package in the templates.
2015-11-17 17:13:12 +01:00
# Enable as-needed and relro by default.
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
_LDFLAGS="-Wl,--as-needed ${LDFLAGS}"
xbps-src: move compiler/linker defaults to env/hardening.sh. The user can still set his/her defaults via etc/conf, and per package in the templates.
2015-11-17 17:13:12 +01:00
env/hardening: handle {i686,mips,mipsel}-musl in a common place.
2015-12-12 08:32:38 +01:00
case "$XBPS_TARGET_MACHINE" in
i686-musl) # SSP currently broken (see https://github.com/voidlinux/void-packages/issues/2902)
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
_CFLAGS+=" -fno-stack-protector"
_CXXFLAGS+=" -fno-stack-protector"
env/hardening: handle {i686,mips,mipsel}-musl in a common place.
2015-12-12 08:32:38 +01:00
;;
esac
if [ -z "$nopie" ]; then
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
_GCCSPECSDIR=${XBPS_COMMONDIR}/environment/configure/gccspecs
env/hardening: reenable hardening for MIPS. I just booted a full PIE base-system successfully on my CI20 Creator. For now we set -fPIE again in C{,XX}FLAGS to fix the build in attr/acl/coreutils, etc.
2016-04-27 12:46:08 +02:00
case "$XBPS_TARGET_MACHINE" in
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
mips*) _GCCSPECSFILE=${_GCCSPECSDIR}/hardened-mips-cc1;;
*) _GCCSPECSFILE=${_GCCSPECSDIR}/hardened-cc1;;
env/hardening: reenable hardening for MIPS. I just booted a full PIE base-system successfully on my CI20 Creator. For now we set -fPIE again in C{,XX}FLAGS to fix the build in attr/acl/coreutils, etc.
2016-04-27 12:46:08 +02:00
esac
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
CFLAGS="-specs=${_GCCSPECSFILE} ${_CFLAGS}"
CXXFLAGS="-specs=${_GCCSPECSFILE} ${_CXXFLAGS}"
xbps-src: move compiler/linker defaults to env/hardening.sh. The user can still set his/her defaults via etc/conf, and per package in the templates.
2015-11-17 17:13:12 +01:00
# We pass -z relro -z now here too, because libtool drops -specs...
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
LDFLAGS="-specs=${_GCCSPECSDIR}/hardened-ld -Wl,-z,relro -Wl,-z,now ${_LDFLAGS}"
xbps-src: move compiler/linker defaults to env/hardening.sh. The user can still set his/her defaults via etc/conf, and per package in the templates.
2015-11-17 17:13:12 +01:00
fi
env/hardening: fix hardening on MIPS. Thanks to @chneukirchen for finding the correct solution: gcc sets -mno-shared by default when compiling non-PIC, and because we are overriding the builtin specs, this internal rule set for gnu/mips does not trigger: gcc/config/mips/gnu-user.h:/* Default to -mno-shared for non-PIC. */ gcc/config/mips/gnu-user.h: " %{mshared|mno-shared|fpic|fPIC|fpie|fPIE:;:-mno-shared}" So that we now use a specific specs file just for mips that sets -mshared for PIC. This fixes building packages with hardening enabled for MIPS.
2016-04-27 15:01:40 +02:00
unset _CFLAGS _CXXFLAGS _LDFLAGS