From df0bd42fdeb76c9bc51b816c3df699db123c0024 Mon Sep 17 00:00:00 2001 From: Julien Dusser Date: Mon, 8 Jan 2018 23:47:06 +0100 Subject: build: add hardened builds with PIE (ASLR) support Introduce a configuration option to build a "hardened" OpenWrt with ASLR PIE support. Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR) by building Position Independent Executables (PIE). This new option protects against "return-to-text" attacks. Busybox need a special care, link is done with ld, not gcc, leading to unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE. If other failing packages were found, PKG_ASLR_PIE:=0 should be added to their Makefiles. Original Work by: Yongkui Han Signed-off-by: Julien Dusser --- include/hardening.mk | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include/hardening.mk') diff --git a/include/hardening.mk b/include/hardening.mk index c277081c51..06a61789ef 100644 --- a/include/hardening.mk +++ b/include/hardening.mk @@ -6,6 +6,7 @@ # PKG_CHECK_FORMAT_SECURITY ?= 1 +PKG_ASLR_PIE ?= 1 PKG_SSP ?= 1 PKG_FORTIFY_SOURCE ?= 1 PKG_RELRO ?= 1 @@ -15,6 +16,12 @@ ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY TARGET_CFLAGS += -Wformat -Werror=format-security endif endif +ifdef CONFIG_PKG_ASLR_PIE + ifeq ($(strip $(PKG_ASLR_PIE)),1) + TARGET_CFLAGS += -fPIC + TARGET_LDFLAGS += -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs + endif +endif ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR ifeq ($(strip $(PKG_SSP)),1) TARGET_CFLAGS += -fstack-protector -- cgit v1.2.3