[OE-core] blocking pie in recipes that build shared object files
Peter A. Bigot
pab at pabigot.com
Tue Aug 5 09:31:08 UTC 2014
On 08/04/2014 05:39 PM, Khem Raj wrote:
> On 14-08-04 09:56:37, Peter A. Bigot wrote:
>> I've now hit two recipes in meta-openembedded that fail on armv7-a because
>> SECURITY_CFLAGS has -pie as an option that leaks into a link command
>> building a shared object file. This produces:
>>
>> |
>> /prj/oe/omap/build-beaglebone-master/tmp/sysroots/beaglebone/usr/lib/Scrt1.o:
>> In function `_start':
>> | /prj/oe/omap/build-beaglebone-master/tmp/work/cortexa8hf-vfp-neon-poky-linux-gnueabi/eglibc/2.19-r0/eglibc-2.19/libc/csu/../ports/sysdeps/arm/start.S:128:
>> undefined reference to `main'
>> | collect2: error: ld returned 1 exit status
>> | error: command 'arm-poky-linux-gnueabi-gcc' failed with exit status 1
>>
>> In openembedded-core meta/conf/distro/include/security_flags.inc provides a
>> bunch of package-specific overrides to use SECURITY_NO_PIE_CFLAGS for this
>> sort of package.
>>
>> It's not clear to me how that should be accomplished for recipes that are
>> not part of openembedded-core. For
>> http://patches.openembedded.org/patch/77165/ for python-smbus in meta-python
>> I chose to override it in the bb file.
>>
>> What is the best-practices solution to this problem?
> may be add SECURITY_CFLAGS_pn-blah = "${SECURITY_NO_PIE_CFLAGS}"
> to layer.conf of given layer where recipe resides
Could do that. Is there precedent?
Looking into this more, the reason I'm hitting this is I'm using
DISTRO=poky-lsb, which gives me oe-core's
conf/distro/include/security_flags.inc automatically.
Now that I know more I'm uncomfortable about putting a distro-specific
workaround in each recipe patch I submit, and more uncomfortable about
creating new precedent by putting distro-specific workarounds in
layer.conf files. Updates to python-smbus in meta-python and rrdtool in
meta-oe are affected by this, plus the 42 package exceptions already
listed in security_flags.inc.
I'm going to stop using poky-lsb for now to hide the problem, but for
the future we need guidance on how to make recipes/layers compatible
with distros that want to enable security_flags.inc.
Peter
More information about the Openembedded-core
mailing list