build: add hardened builds with PIE (ASLR) support
authorJulien Dusser <julien.dusser@free.fr>
Mon, 8 Jan 2018 22:47:06 +0000 (23:47 +0100)
committerHauke Mehrtens <hauke@hauke-m.de>
Sat, 27 Jan 2018 15:46:45 +0000 (16:46 +0100)
commitdf0bd42fdeb76c9bc51b816c3df699db123c0024
tree1057e289580397c014b2c9c4460057e9e7ac8367
parentca7e8627dbbbcae0d1bfacea51d9b564617195de
build: add hardened builds with PIE (ASLR) support

Introduce a configuration option to build a "hardened" OpenWrt with
ASLR PIE support.

Add new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR)
by building Position Independent Executables (PIE). This new option protects
against "return-to-text" attacks.

Busybox need a special care, link is done with ld, not gcc, leading to
unknown flags. Set BUSYBOX_DEFAULT_PIE instead and disable PKG_ASLR_PIE.

If other failing packages were found, PKG_ASLR_PIE:=0 should be added to
their Makefiles.

Original Work by: Yongkui Han <yonhan@cisco.com>
Signed-off-by: Julien Dusser <julien.dusser@free.fr>
config/Config-build.in
include/hardened-ld-pie.specs [new file with mode: 0644]
include/hardening.mk
package/utils/busybox/Makefile