The security flags we apply when a distro includes security_flags.inc should be enhanced in-line with the best practices in widely deployed distributions such as Fedora[1][2], Debian[3][4] and Ubuntu[5]. The aim of this bug is to determine an appropriate list of flags to add to security_includes and ensure that we can perform a world build of OE-Core (and poky) with those flags enabled. For any recipes which fail we will remove the flags which cause failures in a recipe-specific override. Further bugs will be filed to investigate any recipes which require these overrides. 1. https://fedoraproject.org/wiki/Security_Features_Matrix#Userspace_Hardening 2. https://fedoraproject.org/wiki/Packaging:Guidelines?rd=Packaging/Guidelines#Compiler_flags 3. https://wiki.debian.org/Hardening 4. https://wiki.debian.org/HardeningWalkthrough 5. https://wiki.ubuntu.com/ToolChain/CompilerFlags
Also document for future reference what the flags do, how they should be used, and how to solve common problems.
Series sent to the list for review: http://lists.openembedded.org/pipermail/openembedded-core/2016-August/125370.html I have the beginnings of some docs locally but don't think they'll get done for M3. I should probably split the docs out into a separate bug targeting M4.
Security flags were reviewed and a series proposed, however it was deemed the maintenance overhead for the one significant change (PIE linker flags) is untenable. Review has been performed, marking this issue resolved.