Re: [DistroKit] [PATCH 3/5] v7a: enable stack clash protection

[Roland Hieber <rhi@pengutronix.de>]

Nooo, these need a toolchain version bump because
-fstack-clash-protection is not known to gcc-7. Will send a v2 shortly.

 - Roland

On Fri, Mar 08, 2019 at 11:53:26AM +0100, Roland Hieber wrote:
> This setting was introduced in PTXdist 2019.03.0:
> 
>     Generate code to prevent stack clash style attacks. When this
>     option is enabled, the compiler will only allocate one page of
>     stack space at a time and each page is accessed immediately after
>     allocation. Thus, it prevents allocations from jumping over any
>     stack guard page provided by the operating system.
> 
> Make use of it to get more secure binaries.
> 
> Signed-off-by: Roland Hieber <rhi@pengutronix.de>
> ---
>  configs/platform-v7a/platformconfig | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/configs/platform-v7a/platformconfig b/configs/platform-v7a/platformconfig
> index afb7c7b..6e44290 100644
> --- a/configs/platform-v7a/platformconfig
> +++ b/configs/platform-v7a/platformconfig
> @@ -80,7 +80,7 @@ PTXCONF_COMPILER_PREFIX_BOOTLOADER="${PTXCONF_COMPILER_PREFIX}"
>  PTXCONF_TARGET_HARDEN_STACK=y
>  # PTXCONF_TARGET_HARDEN_STACK_STRONG is not set
>  # PTXCONF_TARGET_HARDEN_STACK_ALL is not set
> -# PTXCONF_TARGET_HARDEN_STACKCLASH is not set
> +PTXCONF_TARGET_HARDEN_STACKCLASH=y
>  PTXCONF_TARGET_HARDEN_FORTIFY=y
>  PTXCONF_TARGET_HARDEN_RELRO=y
>  PTXCONF_TARGET_HARDEN_BINDNOW=y
> -- 
> 2.20.1
> 
> 
> _______________________________________________
> DistroKit mailing list
> DistroKit@pengutronix.de

-- 
Roland Hieber                     | r.hieber@pengutronix.de     |
Pengutronix e.K.                  | https://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim | Phone: +49-5121-206917-5086 |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

_______________________________________________
DistroKit mailing list
DistroKit@pengutronix.de