Re: [meta-security][PATCH v2] systemd: disable linker GCS warning on aarch64

[Trevor Woerner <twoerner@gmail.com>]

On Wed 2025-05-07 @ 06:02:47 PM, Mikko Rapeli wrote:
> openssl asm code is missing GCS branch protections and
> linker throws a warning which currently fails the build.
> Ignore the warning for now since some branch protection
> is still applied and only GCS is missing. Works around:

This only solves the problem for one specific use-case (i.e. when someone is
using meta-security) but leaves build issues for everyone else.

A patch that solves the root cause of the issue (in systemd) would be better.

> 
> .../recipe-sysroot/usr/lib/libcrypto.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
> collect2: error: ld returned 1 exit status
> 
> Cc: Sathishkumar Duraisamy <sathishkumar.d.cbe@gmail.com>
> Cc: Khem Raj <raj.khem@gmail.com>
> Cc: Max Krummenacher <max.krummenacher@toradex.com>
> Cc: Trevor Woerner <twoerner@gmail.com>
> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> ---
>  meta-tpm/recipes-core/systemd/systemd_%.bbappend | 3 +++
>  1 file changed, 3 insertions(+)
> 
> v2: switched from meson.build patching to LDFLAGS since that works
>     as suggested by Khem Raj and tested correctly by Trevor Woerner,
>     tested on genericarm64 machine with swtpm on qemu
> 
> v1: https://lists.yoctoproject.org/g/yocto-patches/message/1524
> 
> diff --git a/meta-tpm/recipes-core/systemd/systemd_%.bbappend b/meta-tpm/recipes-core/systemd/systemd_%.bbappend
> index c53b1e8..deb9164 100644
> --- a/meta-tpm/recipes-core/systemd/systemd_%.bbappend
> +++ b/meta-tpm/recipes-core/systemd/systemd_%.bbappend
> @@ -1,3 +1,6 @@
> +# workaround to GCS branch protection warning treated as error from openssl/libcrypto
> +LDFLAGS:append:aarch64 = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '-Wl,-z,gcs-report-dynamic=none', '', d)}"
> +
>  PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'tpm2', '', d)}"
>  
>  # for encrypted filesystems
> -- 
> 2.43.0
>