- It is opt-out for now so as to give it maximum testing, but it may be
turned opt-in for stable branches depending on the consensus. You
can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
It is harmless to steal the knob as SSP symbols have been provided
by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
(sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
libc will be automatically downgraded to -fstack-protector because it
breaks rtld otherwise.
- This option is unavailable on ia64.
Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.
Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
source upgrades by falling back to GNU ar(1) as necessary. Option
WITH_BSDAR is gone. Option _WITH_GNUAR to aid in upgrades is *not*
supposed to be set by the user.
Stop bootstrapping BSD ar(1) on the next __FreeBSD_version bump, as
there are no known bugs in it. Bump __FreeBSD_version to anticipate
this and to flag the switch to BSD ar(1), should it be needed for
something.
Input from: obrien, des, kaiw
and usr.bin/truss/ioctl.c. This is the correct way to address the problem
that arises when doing an incremental build after a header used by kdump
has been removed (cf. i4b disconnect a while ago)
Explained by: ru
MFC after: 2 weeks
through scanning its output as ldd(1) returns a non-zero status only
for really abnormal conditions such as an improper file format.
Now cp(1) won't get bogus "not" and "found" arguments if a lib
is missing. [1]
- Don't guess if an element of a complex pipeline is assigned to the main
shell or a sub-shell. Namely use stdio, not vars, to pass lists out from
loops. If using vars, there's the risk that a loop will run in a sub-shell
and the list won't make it to the main shell. It appears that braces and
parens give only limited control over the issue while stdio always works
as intended. Apply this solution to both $progs and $libs for consistency,
although I've failed to go without it only in the $libs part.
Requested by: emaste [1]
I.e., not only copy them to a scratch dir, but also make them use saved
copies of libraries and locale files. That gives us several benefits:
1) ABI breakages should no longer affect installworld over the live system.
2) It becomes safe to run installworld while still running the old kernel.
However, it can be reasonable to save the old /rescue before that to be
able to run the old reboot(8), as the new binaries are rather likely to
fail with the old kernel. Anyhow, it's now possible to upgrade a system
in a single reboot _reliably_.
3) With a bit of hackery around rtld(8), it becomes possible to do destructive
cross-installs, e.g., i386->amd64 over the live system.
The only shared item left between the old and new systems is rtld(8),
which cannot be run from a saved copy easily because its full
pathname is stored in the respective field of each ELF executable.
(In theory, that field could be overridden, e.g., from the environment,
but this can lead to security issues.) That's why a destructive
cross-install isn't possible w/o hackery yet.
Fruitful ideas by: ru
Reviewed by: ru
Tested with: audit(4)
the threading libraries is built. This simplifies the
logic in makefiles that need to check if the pthreads
support is present. It also fixes a bug where we would
build a threading library that we shouldn't have built:
for example, building with WITHOUT_LIBTHR and the default
value of DEFAULT_THREADING_LIB (libthr) would mistakenly
build the libthr library, but not install it.
Approved by: re (kensmith)
their dependency on libc and its versioned symbols. For that to work,
libc needs to be built before any other shared library that might depend
on it. Add necessary glue to make that happen.
Warning, after symbol versioning is enabled, going back is not easy
(use WITHOUT_SYMVER at your own risk).
Change the default thread library to libthr.
There most likely still needs to be a version bump for at least the
thread libraries. If necessary, this will happen later.
lib32 build somewhat. Specifically, instead of spamming
${CC} et al with -I${LIB32TMP}/usr/include which can be
harmful (as has been demonstrated by the ncursesw WIP),
use slightly different approach to achieve the same goal.
This also simplifies things a bit.
Prodded by: rafan
- Remove libnetgraph from the list of prebuilt libraries as
no other library depends on it (snmp_netgraph.so does not
count as we don't build it in the "libraries" target).
- Restore libssh dependencies when compiling with Kerberos
support.
I found one bug. Pass our idea of TARGET_ARCH and TARGET down to
XMAKE, the cross-tools make. Previously it worked because usually
TARGET_ARCH was specified on the initial make's command line.
This should also allow us to simplify the "universe" target, which
I'm currently testing.
