d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enable PIE by default on 64-bit architectures

Browse Source 
This patch adds Position Independent Executables (PIE)
flags for building OS. It allows to enable the ASLR
feature based only on the sysctl knobs, without
need to rebuild the image. Tests showed that
no problems with stability / performance degradation
were seen when using PIEs with ASLR disabled.

The change is limited only for 64-bit architectures.

Use bsd.opts.mk instead of the src.opts.mk in order
to satisfy all build dependencies related to MK_PIE.

Reviewed by: emaste, imp
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D28328
This commit is contained in:
Marcin Wojtas 2021-01-22 13:13:03 +01:00
parent 3aa023643e
commit 9a227a2fd6
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
share/mk/bsd.opts.mk
View File

@ -75,7 +75,6 @@ __DEFAULT_NO_OPTIONS = \
INIT_ALL_PATTERN \ INIT_ALL_PATTERN \
INIT_ALL_ZERO \ INIT_ALL_ZERO \
INSTALL_AS_USER \ INSTALL_AS_USER \
PIE \
RETPOLINE \ RETPOLINE \
STALE_STAGED STALE_STAGED
@ -85,6 +84,21 @@ __DEFAULT_DEPENDENT_OPTIONS = \
STAGING_PROG/STAGING \ STAGING_PROG/STAGING \
STALE_STAGED/STAGING \ STALE_STAGED/STAGING \
#
# Default to disabling PIE on 32-bit architectures. The small address space
# means that ASLR is of limited effectiveness, and it may cause issues with
# some memory-hungry workloads.
#
.if ${MACHINE_ARCH} == "armv6" || ${MACHINE_ARCH} == "armv7" \
|| ${MACHINE_ARCH} == "i386" || ${MACHINE_ARCH} == "mips" \
|| ${MACHINE_ARCH} == "mipsel" || ${MACHINE_ARCH} == "mipselhf" \
|| ${MACHINE_ARCH} == "mipshf" || ${MACHINE_ARCH} == "mipsn32" \
|| ${MACHINE_ARCH} == "mipsn32el" || ${MACHINE_ARCH} == "powerpc" \
|| ${MACHINE_ARCH} == "powerpcspe"
__DEFAULT_NO_OPTIONS+= PIE
.else
__DEFAULT_YES_OPTIONS+=PIE
.endif
.include <bsd.mkopt.mk> .include <bsd.mkopt.mk>