[OE-core] [PATCH] defaultsetup.conf: Enable security flags+pie by default

[Peter Kjellerstedt]

> -----Original Message-----
> From: Khem Raj <raj.khem at gmail.com>
> Sent: den 27 juli 2018 23:27
> To: Peter Kjellerstedt <peter.kjellerstedt at axis.com>
> Cc: ChenQi <Qi.Chen at windriver.com>; Patches and discussions about the
> oe-core layer <openembedded-core at lists.openembedded.org>
> Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security
> flags+pie by default
> 
> On Fri, Jul 27, 2018 at 1:49 PM Peter Kjellerstedt
> <peter.kjellerstedt at axis.com> wrote:
> >
> > > -----Original Message-----
> > > From: openembedded-core-bounces at lists.openembedded.org
> <openembedded-
> > > core-bounces at lists.openembedded.org> On Behalf Of Khem Raj
> > > Sent: den 24 juli 2018 16:12
> > > To: ChenQi <Qi.Chen at windriver.com>
> > > Cc: Patches and discussions about the oe-core layer <openembedded-
> > > core at lists.openembedded.org>
> > > Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security
> > > flags+pie by default
> > >
> > > On Tue, Jul 24, 2018 at 12:30 AM ChenQi <Qi.Chen at windriver.com>
> wrote:
> > > >
> > > > Hi Khem,
> > > >
> > > > The comments in security-flags.inc also needs to be modified to
> > > remove
> > > > 'poky-lsb' info.
> > > >
> > > > I'd suggest we still put it into distro conf file (poky.conf)
> instead
> > > of
> > > > defaultsetup.conf, because defaultsetup.conf is included by
> > > > bitbake.conf. I think things in defaultsetup.conf should be
> necessary
> > > > default values to build things out. I don't think security flags
> is
> > > > necessary to build things out.
> > >
> > > this is the default setup, even non-poky users will get consistent
> > > experience.
> >
> > I have to agree with Chen here. I think requiring security_flags.inc
> from
> > defaultsetup.conf is the wrong thing to do. We use security_flags.inc
> in
> > our setup, and I know how much trouble it has brought. To me, using
> it
> > should be a distro decision, not something that is enforced by the
> use
> > of bitbake.
> 
> Thats fine, I can move this to poky distro settings, using it by
> default would have
> been in sync for all since reference distro is using it would be
> easier for others when
> submitting patches, as a phase 2 I was also thinking of defaulting to
> hardeing in the toolchain itself
> and remove this file completely that would have made it much better,
> then folks who dont want hardeing could just disable
> it in toolchain. but I am fine to leave it a distro decision for now.

I do not think that relying on the toolchain to handle this is the 
right thing to do, given that some of us use external toolchains in 
addition to the toolchain from OE-Core... With the current setup we 
get roughly the same coverage regardless of which toolchain we use.

//Peter