<br><br>On Tuesday, August 5, 2014, Peter A. Bigot <<a href="mailto:pab@pabigot.com">pab@pabigot.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 08/04/2014 05:39 PM, Khem Raj wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 14-08-04 09:56:37, Peter A. Bigot wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I've now hit two recipes in meta-openembedded that fail on armv7-a because<br>
SECURITY_CFLAGS has -pie as an option that leaks into a link command<br>
building a shared object file. This produces:<br>
<br>
|<br>
/prj/oe/omap/build-beaglebone-<u></u>master/tmp/sysroots/<u></u>beaglebone/usr/lib/Scrt1.o:<br>
In function `_start':<br>
| /prj/oe/omap/build-beaglebone-<u></u>master/tmp/work/cortexa8hf-<u></u>vfp-neon-poky-linux-gnueabi/<u></u>eglibc/2.19-r0/eglibc-2.19/<u></u>libc/csu/../ports/sysdeps/arm/<u></u>start.S:128:<br>
undefined reference to `main'<br>
| collect2: error: ld returned 1 exit status<br>
| error: command 'arm-poky-linux-gnueabi-gcc' failed with exit status 1<br>
<br>
In openembedded-core meta/conf/distro/include/<u></u>security_flags.inc provides a<br>
bunch of package-specific overrides to use SECURITY_NO_PIE_CFLAGS for this<br>
sort of package.<br>
<br>
It's not clear to me how that should be accomplished for recipes that are<br>
not part of openembedded-core. For<br>
<a href="http://patches.openembedded.org/patch/77165/" target="_blank">http://patches.openembedded.<u></u>org/patch/77165/</a> for python-smbus in meta-python<br>
I chose to override it in the bb file.<br>
<br>
What is the best-practices solution to this problem?<br>
</blockquote>
may be add SECURITY_CFLAGS_pn-blah = "${SECURITY_NO_PIE_CFLAGS}"<br>
to layer.conf of given layer where recipe resides<br>
</blockquote>
<br>
Could do that. Is there precedent?</blockquote><div><br></div><div>Don't think so. But you can compare to things like how package blacklisting is done in meta-OE.</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Looking into this more, the reason I'm hitting this is I'm using DISTRO=poky-lsb, which gives me oe-core's conf/distro/include/security_<u></u>flags.inc automatically.<br>
<br>
Now that I know more I'm uncomfortable about putting a distro-specific workaround in each recipe patch I submit, and more uncomfortable about creating new precedent by putting distro-specific workarounds in layer.conf files. Updates to python-smbus in meta-python and rrdtool in meta-oe are affected by this, plus the 42 package exceptions already listed in security_flags.inc.<br>
<br></blockquote><div><br></div><div>I don't think it's so distro related. Security flags is a general OE feature. So layers have to deal with it in distro independent way and IMO it's best place to dictate what recipes in a given layer can support, you can also add this to recipe itself and if numbers of recipes to deal with are less. It's similar to blacklisting feature. </div>
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm going to stop using poky-lsb for now to hide the problem, but for the future we need guidance on how to make recipes/layers compatible with distros that want to enable security_flags.inc. </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Peter<br>
</blockquote>