[oe-commits] Joe Slater : security_flags: eliminate FORTIFY_SOURCE for debug builds

[git at git.openembedded.org]

Module: openembedded-core.git
Branch: master-next
Commit: 1b576012a6a2b2ebc2c507cdaebd62174810b191
URL:    http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=1b576012a6a2b2ebc2c507cdaebd62174810b191

Author: Joe Slater <jslater at windriver.com>
Date:   Thu Jul  2 17:10:51 2015 +0800

security_flags: eliminate FORTIFY_SOURCE for debug builds

If -D_FORTIFY_SOURCE=2 is included in CFLAGS for debug builds,
many warnings will be generated and some packages will fail to
build.  So, only conditionally include it.

Signed-off-by: Joe Slater <jslater at windriver.com>
Signed-off-by: Ross Burton <ross.burton at intel.com>

---

 meta/conf/distro/include/security_flags.inc | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
index 104a6cb..85a3bfe 100644
--- a/meta/conf/distro/include/security_flags.inc
+++ b/meta/conf/distro/include/security_flags.inc
@@ -5,13 +5,18 @@
 # From a Yocto Project perspective, this file is included and tested
 # in the DISTRO="poky-lsb" configuration.
 
-SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie -D_FORTIFY_SOURCE=2"
-SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all -D_FORTIFY_SOURCE=2"
+# _FORTIFY_SOURCE requires -O1 or higher, so disable in debug builds as they use
+# -O0 which then results in a compiler warning.
+lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}"
+
+SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}"
+SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}"
+
 SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now"
 SECURITY_X_LDFLAGS ?= "-Wl,-z,relro"
 
 # powerpc does not get on with pie for reasons not looked into as yet
-SECURITY_CFLAGS_powerpc = "-fstack-protector-all -D_FORTIFY_SOURCE=2"
+SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}"
 # Deal with ppc specific linker failures when using the cflags
 SECURITY_CFLAGS_pn-dbus_powerpc = ""
 SECURITY_CFLAGS_pn-dbus-ptest_powerpc = ""