* [Buildroot] [PATCH 1/2] lxc: fix missing include for va_list @ 2018-12-03 21:46 Fabrice Fontaine 2018-12-03 21:46 ` [Buildroot] [PATCH 2/2] lxc: fix build without stack protector Fabrice Fontaine 0 siblings, 1 reply; 4+ messages in thread From: Fabrice Fontaine @ 2018-12-03 21:46 UTC (permalink / raw) To: buildroot Fixes: - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> --- ...01-stringutils-include-stdarg-for-va_list.patch | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 package/lxc/0001-stringutils-include-stdarg-for-va_list.patch diff --git a/package/lxc/0001-stringutils-include-stdarg-for-va_list.patch b/package/lxc/0001-stringutils-include-stdarg-for-va_list.patch new file mode 100644 index 0000000000..d0a450e8cf --- /dev/null +++ b/package/lxc/0001-stringutils-include-stdarg-for-va_list.patch @@ -0,0 +1,30 @@ +From b7df06ad14c04f18b7db5b64d5142b802bf64cb2 Mon Sep 17 00:00:00 2001 +From: Fabrice Fontaine <fontaine.fabrice@gmail.com> +Date: Mon, 3 Dec 2018 22:18:16 +0100 +Subject: [PATCH] stringutils: include stdarg for va_list + +Fixes: + - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86 + +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> +[Upstream status: https://github.com/lxc/lxc/pull/2745] +--- + src/lxc/string_utils.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/lxc/string_utils.h b/src/lxc/string_utils.h +index 4065e4e6..d4e633cc 100644 +--- a/src/lxc/string_utils.h ++++ b/src/lxc/string_utils.h +@@ -20,6 +20,8 @@ + #ifndef __LXC_STRING_UTILS_H + #define __LXC_STRING_UTILS_H + ++#include <stdarg.h> ++ + #include "config.h" + + #include "initutils.h" +-- +2.14.1 + -- 2.14.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 2/2] lxc: fix build without stack protector 2018-12-03 21:46 [Buildroot] [PATCH 1/2] lxc: fix missing include for va_list Fabrice Fontaine @ 2018-12-03 21:46 ` Fabrice Fontaine 2018-12-03 22:01 ` Thomas Petazzoni 0 siblings, 1 reply; 4+ messages in thread From: Fabrice Fontaine @ 2018-12-03 21:46 UTC (permalink / raw) To: buildroot Add an option to disable the stack protector flags added in version 3.0.3 by https://github.com/lxc/lxc/commit/2268c27754152aa538db2c9e3753d72d19bcd17a Fixes: - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> --- ...ure.ac-add-an-option-to-disable-hardening.patch | 73 ++++++++++++++++++++++ package/lxc/lxc.mk | 4 +- 2 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 package/lxc/0002-configure.ac-add-an-option-to-disable-hardening.patch diff --git a/package/lxc/0002-configure.ac-add-an-option-to-disable-hardening.patch b/package/lxc/0002-configure.ac-add-an-option-to-disable-hardening.patch new file mode 100644 index 0000000000..24dd8f627a --- /dev/null +++ b/package/lxc/0002-configure.ac-add-an-option-to-disable-hardening.patch @@ -0,0 +1,73 @@ +From 165d417003c66be6d2a61e3c6e706e33a6746788 Mon Sep 17 00:00:00 2001 +From: Fabrice Fontaine <fontaine.fabrice@gmail.com> +Date: Mon, 3 Dec 2018 22:29:52 +0100 +Subject: [PATCH] configure.ac: add an option to disable hardening + +Compiler based hardening is enabled since version 3.0.3 and +https://github.com/lxc/lxc/commit/2268c27754152aa538db2c9e3753d72d19bcd17a + +Add an option to disable it as some compilers could missed the needed +library (-lssp or -lssp_nonshared) at linking step + +Fixes: + - http://autobuild.buildroot.org/results/0b9/0b90e7dca2984652842832a41abad93ac49a9b86/build-end.log + +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> +--- + configure.ac | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 9a9adac3..3ff35a61 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -189,6 +189,11 @@ AC_ARG_ENABLE([werror], + [do not treat warnings as errors])], + [], [enable_werror=yes]) + ++AC_ARG_ENABLE([hardening], ++ [AC_HELP_STRING([--disable-hardening], ++ [do not enable hardening compiler options])], ++ [], [enable_hardening=yes]) ++ + # Allow disabling rpath + AC_ARG_ENABLE([rpath], + [AC_HELP_STRING([--enable-rpath], [set rpath in executables [default=no]])], +@@ -695,11 +700,6 @@ AX_CHECK_COMPILE_FLAG([-Wimplicit-fallthrough], [CFLAGS="$CFLAGS -Wimplicit-fall + AX_CHECK_COMPILE_FLAG([-Wcast-align], [CFLAGS="$CFLAGS -Wcast-align"],,[-Werror]) + AX_CHECK_COMPILE_FLAG([-Wstrict-prototypes], [CFLAGS="$CFLAGS -Wstrict-prototypes"],,[-Werror]) + AX_CHECK_COMPILE_FLAG([-fno-strict-aliasing], [CFLAGS="$CFLAGS -fno-strict-aliasing"],,[-Werror]) +-AX_CHECK_COMPILE_FLAG([-fstack-clash-protection], [CFLAGS="$CFLAGS -fstack-clash-protection"],,[-Werror]) +-AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [CFLAGS="$CFLAGS -fstack-protector-strong"],,[-Werror]) +-AX_CHECK_COMPILE_FLAG([-g], [CFLAGS="$CFLAGS -g"],,[-Werror]) +-AX_CHECK_COMPILE_FLAG([--mcet -fcf-protection], [CFLAGS="$CFLAGS --mcet -fcf-protection"],,[-Werror]) +-AX_CHECK_COMPILE_FLAG([-Werror=implicit-function-declaration], [CFLAGS="$CFLAGS -Werror=implicit-function-declaration"],,[-Werror]) + + AX_CHECK_LINK_FLAG([-z relro], [LDLAGS="$LDLAGS -z relro"],,[]) + AX_CHECK_LINK_FLAG([-z now], [LDLAGS="$LDLAGS -z now"],,[]) +@@ -709,6 +709,14 @@ if test "x$enable_werror" = "xyes"; then + CFLAGS="$CFLAGS -Werror" + fi + ++if test "x$enable_hardening" = "xyes"; then ++ AX_CHECK_COMPILE_FLAG([-fstack-clash-protection], [CFLAGS="$CFLAGS -fstack-clash-protection"],,[-Werror]) ++ AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [CFLAGS="$CFLAGS -fstack-protector-strong"],,[-Werror]) ++ AX_CHECK_COMPILE_FLAG([-g], [CFLAGS="$CFLAGS -g"],,[-Werror]) ++ AX_CHECK_COMPILE_FLAG([--mcet -fcf-protection], [CFLAGS="$CFLAGS --mcet -fcf-protection"],,[-Werror]) ++ AX_CHECK_COMPILE_FLAG([-Werror=implicit-function-declaration], [CFLAGS="$CFLAGS -Werror=implicit-function-declaration"],,[-Werror]) ++fi ++ + AC_ARG_ENABLE([thread-safety], + [AC_HELP_STRING([--enable-thread-safety], [enforce thread-safety otherwise fail the build [default=yes]])], + [], [enable_thread_safety=yes]) +@@ -951,6 +959,7 @@ Environment: + - Bash integration: $enable_bash + + Security features: ++ - Compiler hardening options: $enable_hardening + - Apparmor: $enable_apparmor + - Linux capabilities: $enable_capabilities + - seccomp: $enable_seccomp +-- +2.14.1 + diff --git a/package/lxc/lxc.mk b/package/lxc/lxc.mk index 48d5b20329..3af03ab256 100644 --- a/package/lxc/lxc.mk +++ b/package/lxc/lxc.mk @@ -10,9 +10,11 @@ LXC_LICENSE = LGPL-2.1+ LXC_LICENSE_FILES = COPYING LXC_DEPENDENCIES = host-pkgconf LXC_INSTALL_STAGING = YES +# We're patching configure.ac +LXC_AUTORECONF = YES LXC_CONF_OPTS = --disable-apparmor --with-distro=buildroot \ - --disable-werror \ + --disable-hardening --disable-werror \ $(if $(BR2_PACKAGE_BASH),,--disable-bash) ifeq ($(BR2_PACKAGE_GNUTLS),y) -- 2.14.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 2/2] lxc: fix build without stack protector 2018-12-03 21:46 ` [Buildroot] [PATCH 2/2] lxc: fix build without stack protector Fabrice Fontaine @ 2018-12-03 22:01 ` Thomas Petazzoni 2018-12-03 22:13 ` Fabrice Fontaine 0 siblings, 1 reply; 4+ messages in thread From: Thomas Petazzoni @ 2018-12-03 22:01 UTC (permalink / raw) To: buildroot Hello, On Mon, 3 Dec 2018 22:46:37 +0100, Fabrice Fontaine wrote: > Add an option to disable the stack protector flags added in version > 3.0.3 by > https://github.com/lxc/lxc/commit/2268c27754152aa538db2c9e3753d72d19bcd17a > > Fixes: > - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86 > > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Thanks for working on this! > ++if test "x$enable_hardening" = "xyes"; then > ++ AX_CHECK_COMPILE_FLAG([-fstack-clash-protection], [CFLAGS="$CFLAGS -fstack-clash-protection"],,[-Werror]) > ++ AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [CFLAGS="$CFLAGS -fstack-protector-strong"],,[-Werror]) > ++ AX_CHECK_COMPILE_FLAG([-g], [CFLAGS="$CFLAGS -g"],,[-Werror]) Why is -g handled as one of the hardening flags ? Building with debugging symbols can hardly be considered "hardening" :-) Also, is upstream going to accept this --enable/--disable option ? Should we instead use AX_CHECK_LINK_FLAG() ? Thomas -- Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com ^ permalink raw reply [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 2/2] lxc: fix build without stack protector 2018-12-03 22:01 ` Thomas Petazzoni @ 2018-12-03 22:13 ` Fabrice Fontaine 0 siblings, 0 replies; 4+ messages in thread From: Fabrice Fontaine @ 2018-12-03 22:13 UTC (permalink / raw) To: buildroot Dear Thomas, Le lun. 3 d?c. 2018 ? 23:01, Thomas Petazzoni <thomas.petazzoni@bootlin.com> a ?crit : > > Hello, > > On Mon, 3 Dec 2018 22:46:37 +0100, Fabrice Fontaine wrote: > > Add an option to disable the stack protector flags added in version > > 3.0.3 by > > https://github.com/lxc/lxc/commit/2268c27754152aa538db2c9e3753d72d19bcd17a > > > > Fixes: > > - http://autobuild.buildroot.org/results/0b90e7dca2984652842832a41abad93ac49a9b86 > > > > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> > > Thanks for working on this! > > > > ++if test "x$enable_hardening" = "xyes"; then > > ++ AX_CHECK_COMPILE_FLAG([-fstack-clash-protection], [CFLAGS="$CFLAGS -fstack-clash-protection"],,[-Werror]) > > ++ AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [CFLAGS="$CFLAGS -fstack-protector-strong"],,[-Werror]) > > ++ AX_CHECK_COMPILE_FLAG([-g], [CFLAGS="$CFLAGS -g"],,[-Werror]) > > Why is -g handled as one of the hardening flags ? Building with > debugging symbols can hardly be considered "hardening" :-) Indeed ... > > Also, is upstream going to accept this --enable/--disable option ? > Should we instead use AX_CHECK_LINK_FLAG() ? I didn't think about this solution and I have not send this second patch upstream yet. I will try it and send a v2. > > Thomas > -- > Thomas Petazzoni, CTO, Bootlin > Embedded Linux and Kernel engineering > https://bootlin.com Best Regards, Fabrice ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-12-03 22:13 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2018-12-03 21:46 [Buildroot] [PATCH 1/2] lxc: fix missing include for va_list Fabrice Fontaine 2018-12-03 21:46 ` [Buildroot] [PATCH 2/2] lxc: fix build without stack protector Fabrice Fontaine 2018-12-03 22:01 ` Thomas Petazzoni 2018-12-03 22:13 ` Fabrice Fontaine
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.