build: add option for building with stack-protector-all

The GCC option -fstack-protector-all is a security feature used to protect against stack-smashing attacks.
This option enhances the stack-smashing protection provided by -fstack-protector-strong.
-fstack-protector-all option applies stack protection to all functions, regardless of their characteristics.
While this offers the most comprehensive protection against stack-smashing attacks, it can significantly impact
the performance of the program because every function call includes additional checks for stack integrity.
This option can incur a performance penalty because of the extra checks added to every function call,
but it significantly enhances security, making it harder for attackers to exploit buffer overflows to execute arbitrary code.
It's particularly useful in scenarios where security is paramount and performance trade-offs are acceptable.

Signed-off-by: Cedric DOURLENT <cedric.dourlent@softathome.com>

diff --git a/config/Config-build.in b/config/Config-build.in
index ebfce8add448c85954330e54f8193a653cbaa185..24c2bcf13007c7bdf1cb4aba0ba8c390f3415998 100644 (file)
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -293,6 +293,8 @@ menu "Global build settings"
                        bool "Regular"
                config PKG_CC_STACKPROTECTOR_STRONG
                        bool "Strong"
+               config PKG_CC_STACKPROTECTOR_ALL
+                       bool "All"
        endchoice
 
        choice

diff --git a/include/hardening.mk b/include/hardening.mk
index 6acd862f5c4b4531b5c26521d183d823d9d8de4a..4a8874261b92c38d769813b511fd325580290528 100644 (file)
--- a/include/hardening.mk
+++ b/include/hardening.mk
@@ -36,6 +36,11 @@ ifdef CONFIG_PKG_CC_STACKPROTECTOR_STRONG
     TARGET_CFLAGS += -fstack-protector-strong
   endif
 endif
+ifdef CONFIG_PKG_CC_STACKPROTECTOR_ALL
+  ifeq ($(strip $(PKG_SSP)),1)
+    TARGET_CFLAGS += -fstack-protector-all
+  endif
+endif
 ifdef CONFIG_PKG_FORTIFY_SOURCE_1
   ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
     TARGET_CFLAGS += -D_FORTIFY_SOURCE=1