115 lines
3.5 KiB
Diff
115 lines
3.5 KiB
Diff
From 4a3b351a69083567392a70bfb8d91c3f666e0aff Mon Sep 17 00:00:00 2001
|
|
From: Jingxian He <hejingxian@huawei.com>
|
|
Date: Wed, 19 May 2021 22:49:57 +0800
|
|
Subject: [PATCH 57/72] build: add secure compilation options
|
|
|
|
Add secure compilation options:
|
|
-fstack-protector -fstack-protector-all
|
|
-Wl,-z,relro,-z,now,-z,noexecstack
|
|
|
|
Conflict:NA
|
|
Reference:https://gitee.com/src-openeuler/criu/pulls/21
|
|
Signed-off-by: Fu Lin <fulin10@huawei.com>
|
|
---
|
|
Makefile | 4 ++++
|
|
criu/Makefile | 2 +-
|
|
criu/pie/Makefile | 1 +
|
|
criu/pie/Makefile.library | 2 ++
|
|
lib/Makefile | 1 +
|
|
lib/c/Makefile | 2 +-
|
|
scripts/nmk/scripts/build.mk | 5 +++--
|
|
7 files changed, 13 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/Makefile b/Makefile
|
|
index 08761ef..c1eafdd 100644
|
|
--- a/Makefile
|
|
+++ b/Makefile
|
|
@@ -80,6 +80,10 @@ ifeq ($(ARCH),mips)
|
|
DEFINES := -DCONFIG_MIPS
|
|
endif
|
|
|
|
+# secure compilation options
|
|
+CFLAGS += -fstack-protector-all -fPIE
|
|
+LDFLAGS += -pie
|
|
+
|
|
#
|
|
# CFLAGS_PIE:
|
|
#
|
|
diff --git a/criu/Makefile b/criu/Makefile
|
|
index db4e9d8..3b4d69f 100644
|
|
--- a/criu/Makefile
|
|
+++ b/criu/Makefile
|
|
@@ -85,7 +85,7 @@ $(obj)/%: pie
|
|
|
|
$(obj)/criu: $(PROGRAM-BUILTINS)
|
|
$(call msg-link, $@)
|
|
- $(Q) $(CC) $(CFLAGS) $^ $(LIBS) $(WRAPFLAGS) $(LDFLAGS) $(GMONLDOPT) -rdynamic -o $@
|
|
+ $(Q) $(CC) $(CFLAGS) $^ $(LIBS) $(WRAPFLAGS) $(LDFLAGS) $(GMONLDOPT) -rdynamic -o $@ -Wl,-z,relro,-z,now,-z,noexecstack -fPIE -pie
|
|
|
|
UNIT-BUILTINS += $(obj)/config.o
|
|
UNIT-BUILTINS += $(obj)/log.o
|
|
diff --git a/criu/pie/Makefile b/criu/pie/Makefile
|
|
index 265dcf8..40b5804 100644
|
|
--- a/criu/pie/Makefile
|
|
+++ b/criu/pie/Makefile
|
|
@@ -6,6 +6,7 @@ target := parasite restorer
|
|
|
|
CFLAGS := $(filter-out -pg $(CFLAGS-GCOV) $(CFLAGS-ASAN),$(CFLAGS))
|
|
CFLAGS += $(CFLAGS_PIE)
|
|
+CFLAGS := $(filter-out -fstack-protector -fstack-protector-all,$(CFLAGS))
|
|
ccflags-y += -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0
|
|
ccflags-y += -Wp,-U_FORTIFY_SOURCE -Wp,-D_FORTIFY_SOURCE=0
|
|
|
|
diff --git a/criu/pie/Makefile.library b/criu/pie/Makefile.library
|
|
index da2a2fa..c022d06 100644
|
|
--- a/criu/pie/Makefile.library
|
|
+++ b/criu/pie/Makefile.library
|
|
@@ -27,3 +27,5 @@ CFLAGS += $(CFLAGS_PIE)
|
|
ifeq ($(ARCH),mips)
|
|
CFLAGS += -fno-stack-protector -DCR_NOGLIBC -mno-abicalls -fno-pic
|
|
endif
|
|
+
|
|
+CFLAGS := $(filter-out -fstack-protector -fstack-protector-all,$(CFLAGS))
|
|
diff --git a/lib/Makefile b/lib/Makefile
|
|
index 575a7ba..729c298 100644
|
|
--- a/lib/Makefile
|
|
+++ b/lib/Makefile
|
|
@@ -14,6 +14,7 @@ lib/c/Makefile: ;
|
|
lib/c/%: .FORCE
|
|
$(Q) $(MAKE) $(build)=lib/c $@
|
|
|
|
+CFLAGS := $(filter-out -fPIE,$(CFLAGS))
|
|
cflags-so += $(CFLAGS) -rdynamic -Wl,-soname,$(CRIU_SO).$(CRIU_SO_VERSION_MAJOR)
|
|
ldflags-so += -lprotobuf-c
|
|
|
|
diff --git a/lib/c/Makefile b/lib/c/Makefile
|
|
index af01467..d7f6491 100644
|
|
--- a/lib/c/Makefile
|
|
+++ b/lib/c/Makefile
|
|
@@ -4,5 +4,5 @@ obj-y += ./images/rpc.pb-c.o
|
|
ccflags-y += -iquote criu/$(ARCH_DIR)/include
|
|
ccflags-y += -iquote criu/include
|
|
ccflags-y += -iquote images
|
|
-ccflags-y += -fPIC -fno-stack-protector
|
|
+ccflags-y += -fPIC
|
|
ldflags-y += -r -z noexecstack
|
|
diff --git a/scripts/nmk/scripts/build.mk b/scripts/nmk/scripts/build.mk
|
|
index d01d2b7..6f366d7 100644
|
|
--- a/scripts/nmk/scripts/build.mk
|
|
+++ b/scripts/nmk/scripts/build.mk
|
|
@@ -15,8 +15,9 @@ lib-name :=
|
|
lib-target :=
|
|
hostprogs-y :=
|
|
libso-y :=
|
|
-ld_flags :=
|
|
-ldflags-so :=
|
|
+ld_flags := -Wl,-z,relro,-z,now,-z,noexecstack
|
|
+ldflags-so := -Wl,-z,relro,-z,now,-z,noexecstack
|
|
+ldflags-y := -z relro -z now -z noexecstack
|
|
arflags-y :=
|
|
target :=
|
|
deps-y :=
|
|
--
|
|
2.34.1
|
|
|