71 lines
2.1 KiB
Diff
71 lines
2.1 KiB
Diff
From 638ee431907af6e9f4916e95a4f367e14499e819 Mon Sep 17 00:00:00 2001
|
||
From: Qi Tao <taoqi10@huawei.com>
|
||
Date: Thu, 18 Jan 2024 21:12:11 +0800
|
||
Subject: [PATCH 3/3] uadk_engine: add secure compilation option
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
Add PIE, PIC, BIND_NOW, SP, NO Rpath/RunPath, FS,
|
||
Ftrapv and Strip compilation options.
|
||
|
||
PIC（-fPIC):
|
||
Generate position-Independent-Code and andomly load
|
||
dynamic libraries.
|
||
PIE(-fPIE -pie):
|
||
Generate location-independent executables,which
|
||
reduces the probability of fixed address attacks
|
||
and buffer overflow attacks.
|
||
BIND_NOW(-Wl,-z,relro,-z,now):
|
||
GOT table redirects all read-only,which defends
|
||
against ret2plt attacks.
|
||
SP(-fstack-protector-strong/all):
|
||
Determine whether an overflow attack occurs.
|
||
Strip(-Wl,-s):
|
||
Deleting symbol tables defends against hacker
|
||
attacks and reduces the file size.
|
||
FS(-D_FORTIFY_SOURCE=2 -O2):
|
||
Provides access checks for fixed-size buffers
|
||
at compile time and at run time.
|
||
Ftrapv(-ftrapv):
|
||
Detects integer overflow.
|
||
NO Rpath/RunPath(hardcode_into_libs=no):
|
||
Eliminates dynamic library search paths,
|
||
which defense against attacks by replacing
|
||
dynamic libraries with the same name.
|
||
|
||
Signed-off-by: Qi Tao <taoqi10@huawei.com>
|
||
---
|
||
configure.ac | 1 +
|
||
src/Makefile.am | 2 ++
|
||
2 files changed, 3 insertions(+)
|
||
|
||
diff --git a/configure.ac b/configure.ac
|
||
index 6c5369e..99b85e9 100644
|
||
--- a/configure.ac
|
||
+++ b/configure.ac
|
||
@@ -7,6 +7,7 @@ AC_CONFIG_HEADERS([config.h])
|
||
|
||
AC_PROG_CC
|
||
LT_INIT
|
||
+AC_SUBST([hardcode_into_libs], [no])
|
||
|
||
AC_ARG_ENABLE(kae,
|
||
AS_HELP_STRING([--enable-kae],[Enable kae support]))
|
||
diff --git a/src/Makefile.am b/src/Makefile.am
|
||
index c4b8aa9..e014052 100644
|
||
--- a/src/Makefile.am
|
||
+++ b/src/Makefile.am
|
||
@@ -18,6 +18,8 @@ uadk_engine_la_LIBADD=-ldl $(WD_LIBS) -lpthread
|
||
uadk_engine_la_LDFLAGS=-module -version-number $(VERSION)
|
||
uadk_engine_la_CFLAGS=$(WD_CFLAGS) $(libcrypto_CFLAGS)
|
||
uadk_engine_la_CFLAGS+=-DCRYPTO
|
||
+uadk_engine_la_CFLAGS+=-fPIC -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 \
|
||
+ -O2 -ftrapv -Wl,-z,relro,-z,now -Wl,-s
|
||
|
||
AUTOMAKE_OPTIONS = subdir-objects
|
||
|
||
--
|
||
2.25.1
|
||
|