From: Joe Slater <[email protected]> If -D_FORTIFY_SOURCE=2 is included in CFLAGS for debug builds, many warnings will be generated and some packages will fail to build. So, only conditionally include it.
Signed-off-by: Joe Slater <[email protected]> --- meta/conf/distro/include/security_flags.inc | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index 104a6cb..9dbce57 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc @@ -5,13 +5,18 @@ # From a Yocto Project perspective, this file is included and tested # in the DISTRO="poky-lsb" configuration. -SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2" -SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all -D_FORTIFY_SOURCE=2" +# _FORTIFY_SOURCE does not play well with debug builds +# +lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" + +SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}" +SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}" + SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" # powerpc does not get on with pie for reasons not looked into as yet -SECURITY_CFLAGS_powerpc = "-fstack-protector-all -D_FORTIFY_SOURCE=2" +SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}" # Deal with ppc specific linker failures when using the cflags SECURITY_CFLAGS_pn-dbus_powerpc = "" SECURITY_CFLAGS_pn-dbus-ptest_powerpc = "" -- 1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
