ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-19 13:48:06 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
main
openwrt/include/hardening.mk

67 lines
1.7 KiB
Makefile
Raw Permalink Normal View History

build: use SPDX license tags The license folder is a core part of OpenWrt and all GPL-2.0 licensed. Use SPDX license tags to allow machines to check licenses. Signed-off-by: Paul Spooren <mail@aparcar.org> [rebase, keep some Copyright lines, sharpen commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-22 02:48:37 +00:00
# SPDX-License-Identifier: GPL-2.0-only
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
#
build: use SPDX license tags The license folder is a core part of OpenWrt and all GPL-2.0 licensed. Use SPDX license tags to allow machines to check licenses. Signed-off-by: Paul Spooren <mail@aparcar.org> [rebase, keep some Copyright lines, sharpen commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-22 02:48:37 +00:00
# Copyright (C) 2015-2020 OpenWrt.org
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
PKG_CHECK_FORMAT_SECURITY ?= 1
build: add hardened builds with PIE (ASLR) support Introduce a configuration option to build a "hardened" OpenWrt with ASLR PIE support. Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR) by building Position Independent Executables (PIE). This new option protects against "return-to-text" attacks. Busybox need a special care, link is done with ld, not gcc, leading to unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE. If other failing packages were found, PKG_ASLR_PIE:=0 should be added to their Makefiles. Original Work by: Yongkui Han <yonhan@cisco.com> Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2018-01-08 22:47:06 +00:00
PKG_ASLR_PIE ?= 1
buildsystem: Make PIE ASLR option tristate This tristate choose allows to select to build only some applications with PIE enabled. On MIPS binaries are getting about 30% bigger when PIE is activated for the, which is a huge increase. Network exposed applications like dnsmasq should then be build with PIE enabled, but some applications which are normally not parsing data from the network do not have it activated. The regular option should give a good trade off between extra flash and RAM memory usage and security. This changes the default from building no applications with PIE to build some specifically marked applications with PIE enabled. This option is only activated for targets with bigger flash and RAM to not consume extra memory on the very small targets. On SDK builds the Regular option should always be selected, because some tiny targets share the applications with big targets and only the images for the tiny targets should contain the none PIE applications, but the images for the normal targets should use PIE. The shared packages should always use PIE when it should be normally activated. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: Petr Štetiar <ynezz@true.cz>
2019-10-27 13:37:45 +00:00
PKG_ASLR_PIE_REGULAR ?= 0
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
PKG_SSP ?= 1
PKG_FORTIFY_SOURCE ?= 1
PKG_RELRO ?= 1
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
ifeq ($(strip $(PKG_CHECK_FORMAT_SECURITY)),1)
TARGET_CFLAGS += -Wformat -Werror=format-security
endif
endif
buildsystem: Make PIE ASLR option tristate This tristate choose allows to select to build only some applications with PIE enabled. On MIPS binaries are getting about 30% bigger when PIE is activated for the, which is a huge increase. Network exposed applications like dnsmasq should then be build with PIE enabled, but some applications which are normally not parsing data from the network do not have it activated. The regular option should give a good trade off between extra flash and RAM memory usage and security. This changes the default from building no applications with PIE to build some specifically marked applications with PIE enabled. This option is only activated for targets with bigger flash and RAM to not consume extra memory on the very small targets. On SDK builds the Regular option should always be selected, because some tiny targets share the applications with big targets and only the images for the tiny targets should contain the none PIE applications, but the images for the normal targets should use PIE. The shared packages should always use PIE when it should be normally activated. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: Petr Štetiar <ynezz@true.cz>
2019-10-27 13:37:45 +00:00
ifdef CONFIG_PKG_ASLR_PIE_ALL
build: add hardened builds with PIE (ASLR) support Introduce a configuration option to build a "hardened" OpenWrt with ASLR PIE support. Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR) by building Position Independent Executables (PIE). This new option protects against "return-to-text" attacks. Busybox need a special care, link is done with ld, not gcc, leading to unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE. If other failing packages were found, PKG_ASLR_PIE:=0 should be added to their Makefiles. Original Work by: Yongkui Han <yonhan@cisco.com> Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2018-01-08 22:47:06 +00:00
ifeq ($(strip $(PKG_ASLR_PIE)),1)
build: ASLR hardening use $(FPIC) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2018-06-09 08:11:24 +00:00
TARGET_CFLAGS += $(FPIC)
build: fix ASLR for LTO packages Fix building packages with LTO when CONFIG_PKG_ASLR_PIE is enabled. Despite comment of PR lto/80838, it seems that GCC needs -fPIC on linker command line, even if all objects are -fPIC. This may change as PR lto/80838 is merged into 8.1 compile-tested: ar71xx, ath79 Fix commits: 6dac92a42e052f89971762173daabb7fd84742ef 8c11133c9de632dca69c8464f911d8e2716effe2 07940acc341ee9bb2887359f193625e48f36207e e7397eef69a20fc630148d0e597523e139d21c0c ef16a394d2b24a363b50b5b4720cb23fe156c9da ef96d1e34a990871c912938c336f51a510b1e32f 47b42137ce1e931ae5871952b1f98438396f5e07 73fc67b61480a3430d31de33478a1c0c2c364b9c 154c0c4006daf41e2cbb6c8b7ad5557f83dfea3e 804c51e1e661819c5a7532e66fb8a12166eef9a9 Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2018-07-17 16:29:34 +00:00
TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
build: add hardened builds with PIE (ASLR) support Introduce a configuration option to build a "hardened" OpenWrt with ASLR PIE support. Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR) by building Position Independent Executables (PIE). This new option protects against "return-to-text" attacks. Busybox need a special care, link is done with ld, not gcc, leading to unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE. If other failing packages were found, PKG_ASLR_PIE:=0 should be added to their Makefiles. Original Work by: Yongkui Han <yonhan@cisco.com> Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2018-01-08 22:47:06 +00:00
endif
endif
buildsystem: Make PIE ASLR option tristate This tristate choose allows to select to build only some applications with PIE enabled. On MIPS binaries are getting about 30% bigger when PIE is activated for the, which is a huge increase. Network exposed applications like dnsmasq should then be build with PIE enabled, but some applications which are normally not parsing data from the network do not have it activated. The regular option should give a good trade off between extra flash and RAM memory usage and security. This changes the default from building no applications with PIE to build some specifically marked applications with PIE enabled. This option is only activated for targets with bigger flash and RAM to not consume extra memory on the very small targets. On SDK builds the Regular option should always be selected, because some tiny targets share the applications with big targets and only the images for the tiny targets should contain the none PIE applications, but the images for the normal targets should use PIE. The shared packages should always use PIE when it should be normally activated. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: Petr Štetiar <ynezz@true.cz>
2019-10-27 13:37:45 +00:00
ifdef CONFIG_PKG_ASLR_PIE_REGULAR
ifeq ($(strip $(PKG_ASLR_PIE_REGULAR)),1)
TARGET_CFLAGS += $(FPIC)
TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
endif
endif
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
ifeq ($(strip $(PKG_SSP)),1)
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
TARGET_CFLAGS += -fstack-protector
endif
endif
ifdef CONFIG_PKG_CC_STACKPROTECTOR_STRONG
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
ifeq ($(strip $(PKG_SSP)),1)
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
TARGET_CFLAGS += -fstack-protector-strong
endif
endif
build: add option for building with stack-protector-all The GCC option -fstack-protector-all is a security feature used to protect against stack-smashing attacks. This option enhances the stack-smashing protection provided by -fstack-protector-strong. -fstack-protector-all option applies stack protection to all functions, regardless of their characteristics. While this offers the most comprehensive protection against stack-smashing attacks, it can significantly impact the performance of the program because every function call includes additional checks for stack integrity. This option can incur a performance penalty because of the extra checks added to every function call, but it significantly enhances security, making it harder for attackers to exploit buffer overflows to execute arbitrary code. It's particularly useful in scenarios where security is paramount and performance trade-offs are acceptable. Signed-off-by: Cedric DOURLENT <cedric.dourlent@softathome.com>
2024-01-12 08:23:46 +00:00
ifdef CONFIG_PKG_CC_STACKPROTECTOR_ALL
ifeq ($(strip $(PKG_SSP)),1)
TARGET_CFLAGS += -fstack-protector-all
endif
endif
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
ifdef CONFIG_PKG_FORTIFY_SOURCE_1
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
TARGET_CFLAGS += -D_FORTIFY_SOURCE=1
endif
endif
ifdef CONFIG_PKG_FORTIFY_SOURCE_2
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
TARGET_CFLAGS += -D_FORTIFY_SOURCE=2
endif
endif
ifdef CONFIG_PKG_RELRO_PARTIAL
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
ifeq ($(strip $(PKG_RELRO)),1)
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
TARGET_CFLAGS += -Wl,-z,relro
TARGET_LDFLAGS += -zrelro
endif
endif
ifdef CONFIG_PKG_RELRO_FULL
hardening: make override variables more intuitive Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46119
2015-06-24 10:57:14 +00:00
ifeq ($(strip $(PKG_RELRO)),1)
buildroot: move hardening options into separate file Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46070
2015-06-20 17:37:18 +00:00
TARGET_CFLAGS += -Wl,-z,now -Wl,-z,relro
TARGET_LDFLAGS += -znow -zrelro
endif
endif
Reference in New Issue Copy Permalink