71 lines
2.0 KiB
Diff
71 lines
2.0 KiB
Diff
|
From 4cd0b3e82205767ac151835e69736c61aca4eda8 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Qi Tao <taoqi10@huawei.com>
|
|||
|
|
Date: Thu, 18 Jan 2024 21:07:26 +0800
|
|||
|
|
Subject: [PATCH 3/8] uadk: add secure compilation option
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
Add PIE, PIC, BIND_NOW, SP, NO Rpath/RunPath, FS,
|
|||
|
|
Ftrapv and Strip compilation options.
|
|||
|
|
|
|||
|
|
PIC（-fPIC):
|
|||
|
|
Generate position-Independent-Code and andomly
|
|||
|
|
load dynamic libraries.
|
|||
|
|
PIE(-fPIE -pie):
|
|||
|
|
Generate location-independent executables,which
|
|||
|
|
reduces the probability of fixed address attacks
|
|||
|
|
and buffer overflow attacks.
|
|||
|
|
BIND_NOW(-Wl,-z,relro,-z,now):
|
|||
|
|
GOT table redirects all read-only,which defends
|
|||
|
|
against ret2plt attacks.
|
|||
|
|
SP(-fstack-protector-strong/all):
|
|||
|
|
Determine whether an overflow attack occurs.
|
|||
|
|
Strip(-Wl,-s):
|
|||
|
|
Deleting symbol tables defends against hacker
|
|||
|
|
attacks and reduces the file size.
|
|||
|
|
FS(-D_FORTIFY_SOURCE=2 -O2):
|
|||
|
|
Provides access checks for fixed-size buffers
|
|||
|
|
at compile time and at run time.
|
|||
|
|
Ftrapv(-ftrapv):
|
|||
|
|
Detects integer overflow.
|
|||
|
|
NO Rpath/RunPath(hardcode_into_libs=no):
|
|||
|
|
Eliminates dynamic library search paths,
|
|||
|
|
which defense against attacks by replacing
|
|||
|
|
dynamic libraries with the same name.
|
|||
|
|
|
|||
|
|
Signed-off-by: Qi Tao <taoqi10@huawei.com>
|
|||
|
|
---
|
|||
|
|
Makefile.am | 2 ++
|
|||
|
|
configure.ac | 1 +
|
|||
|
|
2 files changed, 3 insertions(+)
|
|||
|
|
|
|||
|
|
diff --git a/Makefile.am b/Makefile.am
|
|||
|
|
index 51691cb..64cfa44 100644
|
|||
|
|
--- a/Makefile.am
|
|||
|
|
+++ b/Makefile.am
|
|||
|
|
@@ -1,6 +1,8 @@
|
|||
|
|
ACLOCAL_AMFLAGS = -I m4 -I./include
|
|||
|
|
AUTOMAKE_OPTIONS = foreign subdir-objects
|
|||
|
|
AM_CFLAGS=-Wall -Werror -fno-strict-aliasing -I$(top_srcdir)/include
|
|||
|
|
+AM_CFLAGS+=-fPIC -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 \
|
|||
|
|
+ -O2 -ftrapv -Wl,-z,relro,-z,now -Wl,-s
|
|||
|
|
CLEANFILES =
|
|||
|
|
|
|||
|
|
if WITH_LOG_FILE
|
|||
|
|
diff --git a/configure.ac b/configure.ac
|
|||
|
|
index 2692175..b198417 100644
|
|||
|
|
--- a/configure.ac
|
|||
|
|
+++ b/configure.ac
|
|||
|
|
@@ -18,6 +18,7 @@ AM_PROG_AR
|
|||
|
|
AC_PROG_LIBTOOL
|
|||
|
|
AM_PROG_LIBTOOL
|
|||
|
|
LT_INIT
|
|||
|
|
+AC_SUBST([hardcode_into_libs], [no])
|
|||
|
|
AM_PROG_CC_C_O
|
|||
|
|
|
|||
|
|
AC_ARG_ENABLE([debug-log],
|
|||
|
|
--
|
|||
|
|
2.25.1
|
|||
|
|
|