Patchwork openssl: build always with -Wa,--noexecstack

login
register
mail settings
Submitter Enrico Scholz
Date Jan. 12, 2012, 4:30 p.m.
Message ID <1326385824-32201-2-git-send-email-enrico.scholz@sigma-chemnitz.de>
Download mbox | patch
Permalink /patch/19181/
State New
Headers show

Comments

Enrico Scholz - Jan. 12, 2012, 4:30 p.m.
There is no reason to disable exec-stack only for -native builds;
binaries on the target will suffer from the same SELinux ACLs.

OpenSSL does not use executable stack so this option can be disabled
unconditionally.

Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
---
 meta/recipes-connectivity/openssl/openssl.inc |    6 +-----
 1 files changed, 1 insertions(+), 5 deletions(-)
Saul Wold - Jan. 12, 2012, 8:58 p.m.
On 01/12/2012 08:30 AM, Enrico Scholz wrote:
> There is no reason to disable exec-stack only for -native builds;
> binaries on the target will suffer from the same SELinux ACLs.
>
> OpenSSL does not use executable stack so this option can be disabled
> unconditionally.
>
> Signed-off-by: Enrico Scholz<enrico.scholz@sigma-chemnitz.de>
> ---
>   meta/recipes-connectivity/openssl/openssl.inc |    6 +-----
>   1 files changed, 1 insertions(+), 5 deletions(-)
>
> diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc
> index 771f146..65bb671 100644
> --- a/meta/recipes-connectivity/openssl/openssl.inc
> +++ b/meta/recipes-connectivity/openssl/openssl.inc
> @@ -19,11 +19,7 @@ S = "${WORKDIR}/openssl-${PV}"
>
>   AR_append = " r"
>   CFLAG = "${@base_conditional('SITEINFO_ENDIANNESS', 'le', '-DL_ENDIAN', '-DB_ENDIAN', d)} \
> -	-DTERMIO ${FULL_OPTIMIZATION} -Wall"
> -
> -# Avoid binaries being marked as requiring an executable stack (which causes
> -# issues with SELinux on the host)
> -CFLAG_append_virtclass-native = " -Wa,--noexecstack"
> +	-DTERMIO ${FULL_OPTIMIZATION} -Wall -Wa,--noexecstack"
>
>   # -02 does not work on mipsel: ssh hangs when it tries to read /dev/urandom
>   CFLAG_mtx-1 := "${@'${CFLAG}'.replace('-O2', '')}"

Enrico,

Thanks so much for these patches, the recipe changes such as this one, 
binutils, perl, and x11 need to have PR bumps, can you please resubmit 
them with PR increments.

Also, since you have so many could you use an oe-contrib branch to 
submit them?

There may be other comments later.

Thanks
	Sau!

Thanks
	Sau!

Patch

diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc
index 771f146..65bb671 100644
--- a/meta/recipes-connectivity/openssl/openssl.inc
+++ b/meta/recipes-connectivity/openssl/openssl.inc
@@ -19,11 +19,7 @@  S = "${WORKDIR}/openssl-${PV}"
 
 AR_append = " r"
 CFLAG = "${@base_conditional('SITEINFO_ENDIANNESS', 'le', '-DL_ENDIAN', '-DB_ENDIAN', d)} \
-	-DTERMIO ${FULL_OPTIMIZATION} -Wall"
-
-# Avoid binaries being marked as requiring an executable stack (which causes 
-# issues with SELinux on the host)
-CFLAG_append_virtclass-native = " -Wa,--noexecstack"
+	-DTERMIO ${FULL_OPTIMIZATION} -Wall -Wa,--noexecstack"
 
 # -02 does not work on mipsel: ssh hangs when it tries to read /dev/urandom
 CFLAG_mtx-1 := "${@'${CFLAG}'.replace('-O2', '')}"