| Summary: | security_flags.inc has exception packages compiled without any -fstack-protector | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] Security - Recipe Upgrade | Reporter: | Elena Reshetova <elena.reshetova> |
| Component: | security | Assignee: | Alexander Kanavin <alex.kanavin> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Medium | CC: | alex.kanavin, joshuagloe, juro.bystricky, richard.purdie |
| Version: | unspecified | ||
| Target Milestone: | 2.2 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | No (bug/feature does not impact docs) | |
|
Description
Elena Reshetova
2016-04-19 15:02:10 UTC
The difference between the two is that strong protector adds a stack guard to more functions than the regular protector does, but otherwise the protection technique is same. We can try, but I have a hunch that the failing packages will still fail. It's not a lot of packages by the way - grub, gcc, glibc, uclibc and valgrind. I also share the suspicion that they will fail but we could try it. I guess glibc is the main concern. I checked all of those; the only ones where removing stack protection is no longer necessary are gcc-sanitizers and libgcc (in fact, they even work with full SECURITY_NO_PIE_CFLAGS now). I'll do a world build, then send a patch. Patch is in master: 088120816835bfab2a675eb3f265b63290d077e6 |