[OE-core] [PATCH 4/6] security_flags: Replace -fstack-protector-all with -fstack-protector-strong

[Khem Raj]

since gcc 4.9 this is new option added to gcc which is a better version
of fstack-protector-all with reduced stack usage and better performance
yet giving same amount of coverage.

pass fstack-protector-strong to linker flags as well
so ld is passed flags to link with ssp libraries

https://outflux.net/blog/archives/2014/01/27/fstack-protector-strong/

describes it in usablility terms.

Do not use ssp when compiling glibc and gcc libs

ensure that security flags are only used for target packages

Signed-off-by: Khem Raj <raj.khem at gmail.com>
---
 meta/conf/distro/include/security_flags.inc | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
index 7f898ee..ff5d940 100644
--- a/meta/conf/distro/include/security_flags.inc
+++ b/meta/conf/distro/include/security_flags.inc
@@ -9,11 +9,11 @@
 # -O0 which then results in a compiler warning.
 lcl_maybe_fortify = "${@base_conditional('DEBUG_BUILD','1','','-D_FORTIFY_SOURCE=2',d)}"
 
-SECURITY_CFLAGS ?= "-fstack-protector-all -pie -fpie ${lcl_maybe_fortify}"
-SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-all ${lcl_maybe_fortify}"
+SECURITY_CFLAGS ?= "-fstack-protector-strong -pie -fpie ${lcl_maybe_fortify}"
+SECURITY_NO_PIE_CFLAGS ?= "-fstack-protector-strong ${lcl_maybe_fortify}"
 
-SECURITY_LDFLAGS ?= "-Wl,-z,relro,-z,now"
-SECURITY_X_LDFLAGS ?= "-Wl,-z,relro"
+SECURITY_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro,-z,now"
+SECURITY_X_LDFLAGS ?= "-fstack-protector-strong -Wl,-z,relro"
 
 # powerpc does not get on with pie for reasons not looked into as yet
 SECURITY_CFLAGS_powerpc = "-fstack-protector-all ${lcl_maybe_fortify}"
@@ -87,14 +87,14 @@ SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-ltp = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-pulseaudio = "${SECURITY_NO_PIE_CFLAGS}"
 
-TARGET_CFLAGS_append = " ${SECURITY_CFLAGS}"
-TARGET_LDFLAGS_append = " ${SECURITY_LDFLAGS}"
+TARGET_CFLAGS_append_class-target = " ${SECURITY_CFLAGS}"
+TARGET_LDFLAGS_append_class-target = " ${SECURITY_LDFLAGS}"
 
-SECURITY_LDFLAGS_pn-gcc-runtime = ""
-SECURITY_LDFLAGS_pn-gcc-sanitizers = ""
-SECURITY_LDFLAGS_pn-glibc = ""
-SECURITY_LDFLAGS_pn-glibc-initial = ""
-SECURITY_LDFLAGS_pn-libgcc = ""
+SECURITY_LDFLAGS_remove_pn-gcc-runtime = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-gcc-sanitizers = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-glibc = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-glibc-initial = "-fstack-protector-strong"
+SECURITY_LDFLAGS_remove_pn-libgcc = "-fstack-protector-strong"
 SECURITY_LDFLAGS_pn-xf86-video-fbdev = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-intel = "${SECURITY_X_LDFLAGS}"
 SECURITY_LDFLAGS_pn-xf86-video-omapfb = "${SECURITY_X_LDFLAGS}"
-- 
2.7.0