since gcc 4.9 this is new option added to gcc which is a better version of fstack-protector-all with reduced stack usage and better performance yet giving same amount of coverage.
pass fstack-protector-strong to linker flags as well so ld is passed flags to link with ssp libraries https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/ describes it in usablility terms. Signed-off-by: Khem Raj <[email protected]> --- meta/conf/distro/include/security_flags.inc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc index 37570a6..79e09d7 100644 --- a/meta/conf/distro/include/security_flags.inc +++ b/meta/conf/distro/include/security_flags.inc @@ -9,11 +9,11 @@ # -O0 which then results in a compiler warning. lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}" -SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}" -SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}" +SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify}" +SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify}" -SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now" -SECURITY_X_LDFLAGS ?= "-Wl,-z,relro" +SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now" +SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro" # powerpc does not get on with pie for reasons not looked into as yet SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}" -- 2.7.0 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
