[meta-security][PATCH v2] systemd: disable linker GCS warning on aarch64

[meta-security][PATCH v2] systemd: disable linker GCS warning on aarch64

[Mikko Rapeli]

openssl asm code is missing GCS branch protections and
linker throws a warning which currently fails the build.
Ignore the warning for now since some branch protection
is still applied and only GCS is missing. Works around:

.../recipe-sysroot/usr/lib/libcrypto.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
collect2: error: ld returned 1 exit status

Cc: Sathishkumar Duraisamy <sathishkumar.d.cbe@gmail.com>
Cc: Khem Raj <raj.khem@gmail.com>
Cc: Max Krummenacher <max.krummenacher@toradex.com>
Cc: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 meta-tpm/recipes-core/systemd/systemd_%.bbappend | 3 +++
 1 file changed, 3 insertions(+)

v2: switched from meson.build patching to LDFLAGS since that works
    as suggested by Khem Raj and tested correctly by Trevor Woerner,
    tested on genericarm64 machine with swtpm on qemu

v1: https://lists.yoctoproject.org/g/yocto-patches/message/1524

diff --git a/meta-tpm/recipes-core/systemd/systemd_%.bbappend b/meta-tpm/recipes-core/systemd/systemd_%.bbappend
index c53b1e8..deb9164 100644
--- a/meta-tpm/recipes-core/systemd/systemd_%.bbappend
+++ b/meta-tpm/recipes-core/systemd/systemd_%.bbappend
@@ -1,3 +1,6 @@
+# workaround to GCS branch protection warning treated as error from openssl/libcrypto
+LDFLAGS:append:aarch64 = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '-Wl,-z,gcs-report-dynamic=none', '', d)}"
+
 PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'tpm2', '', d)}"
 
 # for encrypted filesystems
-- 
2.43.0

Re: [meta-security][PATCH v2] systemd: disable linker GCS warning on aarch64

[Trevor Woerner]

On Wed 2025-05-07 @ 06:02:47 PM, Mikko Rapeli wrote:
> openssl asm code is missing GCS branch protections and
> linker throws a warning which currently fails the build.
> Ignore the warning for now since some branch protection
> is still applied and only GCS is missing. Works around:

This only solves the problem for one specific use-case (i.e. when someone is
using meta-security) but leaves build issues for everyone else.

A patch that solves the root cause of the issue (in systemd) would be better.

> 
> .../recipe-sysroot/usr/lib/libcrypto.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
> collect2: error: ld returned 1 exit status
> 
> Cc: Sathishkumar Duraisamy <sathishkumar.d.cbe@gmail.com>
> Cc: Khem Raj <raj.khem@gmail.com>
> Cc: Max Krummenacher <max.krummenacher@toradex.com>
> Cc: Trevor Woerner <twoerner@gmail.com>
> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> ---
>  meta-tpm/recipes-core/systemd/systemd_%.bbappend | 3 +++
>  1 file changed, 3 insertions(+)
> 
> v2: switched from meson.build patching to LDFLAGS since that works
>     as suggested by Khem Raj and tested correctly by Trevor Woerner,
>     tested on genericarm64 machine with swtpm on qemu
> 
> v1: https://lists.yoctoproject.org/g/yocto-patches/message/1524
> 
> diff --git a/meta-tpm/recipes-core/systemd/systemd_%.bbappend b/meta-tpm/recipes-core/systemd/systemd_%.bbappend
> index c53b1e8..deb9164 100644
> --- a/meta-tpm/recipes-core/systemd/systemd_%.bbappend
> +++ b/meta-tpm/recipes-core/systemd/systemd_%.bbappend
> @@ -1,3 +1,6 @@
> +# workaround to GCS branch protection warning treated as error from openssl/libcrypto
> +LDFLAGS:append:aarch64 = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '-Wl,-z,gcs-report-dynamic=none', '', d)}"
> +
>  PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'tpm2', '', d)}"
>  
>  # for encrypted filesystems
> -- 
> 2.43.0
> 

Re: [meta-security][PATCH v2] systemd: disable linker GCS warning on aarch64

[Mikko Rapeli]

Hi,

On Wed, May 07, 2025 at 06:02:47PM +0300, Mikko Rapeli wrote:
> openssl asm code is missing GCS branch protections and
> linker throws a warning which currently fails the build.
> Ignore the warning for now since some branch protection
> is still applied and only GCS is missing. Works around:
> 
> .../recipe-sysroot/usr/lib/libcrypto.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
> collect2: error: ld returned 1 exit status

To conclude, this was fixed in oe-core/poky instead.

https://lists.openembedded.org/g/openembedded-core/message/216132

The other patches in the series are still relevant for meta-security/meta-tpm.

Cheers,

-Mikko