Bug 9538

Summary:	Review common security hardening flags and expand security_flags.inc
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Joshua Lock <joshuagloe>
Component:	core	Assignee:	Joshua Lock <joshuagloe>
Status:	RESOLVED FIXED	QA Contact:
Severity:	enhancement
Priority:	Medium+	CC:	jose.perez.carranza, meta.mr.watcher, meta.watcher, richard.purdie, ross.burton
Version:	2.2
Target Milestone:	2.2 M3
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Don't know

Description Joshua Lock 2016-04-28 10:26:53 UTC

The security flags we apply when a distro includes security_flags.inc should be enhanced in-line with the best practices in widely deployed distributions such as Fedora[1][2], Debian[3][4] and Ubuntu[5].

The aim of this bug is to determine an appropriate list of flags to add to security_includes and ensure that we can perform a world build of OE-Core (and poky) with those flags enabled.

For any recipes which fail we will remove the flags which cause failures in a recipe-specific override.

Further bugs will be filed to investigate any recipes which require these overrides.

1. https://fedoraproject.org/wiki/Security_Features_Matrix#Userspace_Hardening
2. https://fedoraproject.org/wiki/Packaging:Guidelines?rd=Packaging/Guidelines#Compiler_flags
3. https://wiki.debian.org/Hardening
4. https://wiki.debian.org/HardeningWalkthrough
5. https://wiki.ubuntu.com/ToolChain/CompilerFlags

Comment 1 Ross Burton 2016-07-01 11:37:42 UTC

Also document for future reference what the flags do, how they should be used, and how to solve common problems.

Comment 2 Joshua Lock 2016-08-19 15:40:33 UTC

Series sent to the list for review:

http://lists.openembedded.org/pipermail/openembedded-core/2016-August/125370.html

I have the beginnings of some docs locally but don't think they'll get done for M3. I should probably split the docs out into a separate bug targeting M4.

Comment 3 Joshua Lock 2016-09-07 15:51:56 UTC

Security flags were reviewed and a series proposed, however it was deemed the maintenance overhead for the one significant change (PIE linker flags) is untenable.

Review has been performed, marking this issue resolved.