> -----Original Message----- > From: Khem Raj <[email protected]> > Sent: den 27 juli 2018 23:27 > To: Peter Kjellerstedt <[email protected]> > Cc: ChenQi <[email protected]>; Patches and discussions about the > oe-core layer <[email protected]> > Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security > flags+pie by default > > On Fri, Jul 27, 2018 at 1:49 PM Peter Kjellerstedt > <[email protected]> wrote: > > > > > -----Original Message----- > > > From: [email protected] > <openembedded- > > > [email protected]> On Behalf Of Khem Raj > > > Sent: den 24 juli 2018 16:12 > > > To: ChenQi <[email protected]> > > > Cc: Patches and discussions about the oe-core layer <openembedded- > > > [email protected]> > > > Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security > > > flags+pie by default > > > > > > On Tue, Jul 24, 2018 at 12:30 AM ChenQi <[email protected]> > wrote: > > > > > > > > Hi Khem, > > > > > > > > The comments in security-flags.inc also needs to be modified to > > > remove > > > > 'poky-lsb' info. > > > > > > > > I'd suggest we still put it into distro conf file (poky.conf) > instead > > > of > > > > defaultsetup.conf, because defaultsetup.conf is included by > > > > bitbake.conf. I think things in defaultsetup.conf should be > necessary > > > > default values to build things out. I don't think security flags > is > > > > necessary to build things out. > > > > > > this is the default setup, even non-poky users will get consistent > > > experience. > > > > I have to agree with Chen here. I think requiring security_flags.inc > from > > defaultsetup.conf is the wrong thing to do. We use security_flags.inc > in > > our setup, and I know how much trouble it has brought. To me, using > it > > should be a distro decision, not something that is enforced by the > use > > of bitbake. > > Thats fine, I can move this to poky distro settings, using it by > default would have > been in sync for all since reference distro is using it would be > easier for others when > submitting patches, as a phase 2 I was also thinking of defaulting to > hardeing in the toolchain itself > and remove this file completely that would have made it much better, > then folks who dont want hardeing could just disable > it in toolchain. but I am fine to leave it a distro decision for now.
I do not think that relying on the toolchain to handle this is the right thing to do, given that some of us use external toolchains in addition to the toolchain from OE-Core... With the current setup we get roughly the same coverage regardless of which toolchain we use. //Peter -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
