[DistroKit] [PATCH 4/5] rpi: enable stack clash protection

[Roland Hieber <rhi@pengutronix.de>]

This setting was introduced in PTXdist 2019.03.0:

    Generate code to prevent stack clash style attacks. When this
    option is enabled, the compiler will only allocate one page of
    stack space at a time and each page is accessed immediately after
    allocation. Thus, it prevents allocations from jumping over any
    stack guard page provided by the operating system.

Make use of it to get more secure binaries.

Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
 configs/platform-rpi/platformconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configs/platform-rpi/platformconfig b/configs/platform-rpi/platformconfig
index 97196e0..c3a64cb 100644
--- a/configs/platform-rpi/platformconfig
+++ b/configs/platform-rpi/platformconfig
@@ -80,7 +80,7 @@ PTXCONF_COMPILER_PREFIX_BOOTLOADER="${PTXCONF_COMPILER_PREFIX}"
 # PTXCONF_TARGET_HARDEN_STACK is not set
 PTXCONF_TARGET_HARDEN_STACK_STRONG=y
 # PTXCONF_TARGET_HARDEN_STACK_ALL is not set
-# PTXCONF_TARGET_HARDEN_STACKCLASH is not set
+PTXCONF_TARGET_HARDEN_STACKCLASH=y
 PTXCONF_TARGET_HARDEN_FORTIFY=y
 PTXCONF_TARGET_HARDEN_RELRO=y
 PTXCONF_TARGET_HARDEN_BINDNOW=y
-- 
2.20.1


_______________________________________________
DistroKit mailing list
DistroKit@pengutronix.de