9538 2016-04-28 10:26:53 +0000 Review common security hardening flags and expand security_flags.inc 2017-12-06 16:53:13 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.2 x86 Multiple RESOLVED FIXED Medium+ enhancement 2.2 M3 1 joshuagloe joshuagloe jose.perez.carranza meta.mr.watcher meta.watcher richard.purdie ross.burton --- --- Don't know oldest_to_newest 61769 0 joshuagloe 2016-04-28 10:26:53 +0000 The security flags we apply when a distro includes security_flags.inc should be enhanced in-line with the best practices in widely deployed distributions such as Fedora[1][2], Debian[3][4] and Ubuntu[5]. The aim of this bug is to determine an appropriate list of flags to add to security_includes and ensure that we can perform a world build of OE-Core (and poky) with those flags enabled. For any recipes which fail we will remove the flags which cause failures in a recipe-specific override. Further bugs will be filed to investigate any recipes which require these overrides. 1. https://fedoraproject.org/wiki/Security_Features_Matrix#Userspace_Hardening 2. https://fedoraproject.org/wiki/Packaging:Guidelines?rd=Packaging/Guidelines#Compiler_flags 3. https://wiki.debian.org/Hardening 4. https://wiki.debian.org/HardeningWalkthrough 5. https://wiki.ubuntu.com/ToolChain/CompilerFlags 63574 1 ross.burton 2016-07-01 11:37:42 +0000 Also document for future reference what the flags do, how they should be used, and how to solve common problems. 65356 2 joshuagloe 2016-08-19 15:40:33 +0000 Series sent to the list for review: http://lists.openembedded.org/pipermail/openembedded-core/2016-August/125370.html I have the beginnings of some docs locally but don't think they'll get done for M3. I should probably split the docs out into a separate bug targeting M4. 65881 3 joshuagloe 2016-09-07 15:51:56 +0000 Security flags were reviewed and a series proposed, however it was deemed the maintenance overhead for the one significant change (PIE linker flags) is untenable. Review has been performed, marking this issue resolved.