| Submitter | Enrico Scholz |
|---|---|
| Date | Jan. 12, 2012, 4:30 p.m. |
| Message ID | <1326385824-32201-2-git-send-email-enrico.scholz@sigma-chemnitz.de> |
| Download | mbox | patch |
| Permalink | /patch/19181/ |
| State | New |
| Headers | show |
Comments
On 01/12/2012 08:30 AM, Enrico Scholz wrote: > There is no reason to disable exec-stack only for -native builds; > binaries on the target will suffer from the same SELinux ACLs. > > OpenSSL does not use executable stack so this option can be disabled > unconditionally. > > Signed-off-by: Enrico Scholz<enrico.scholz@sigma-chemnitz.de> > --- > meta/recipes-connectivity/openssl/openssl.inc | 6 +----- > 1 files changed, 1 insertions(+), 5 deletions(-) > > diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc > index 771f146..65bb671 100644 > --- a/meta/recipes-connectivity/openssl/openssl.inc > +++ b/meta/recipes-connectivity/openssl/openssl.inc > @@ -19,11 +19,7 @@ S = "${WORKDIR}/openssl-${PV}" > > AR_append = " r" > CFLAG = "${@base_conditional('SITEINFO_ENDIANNESS', 'le', '-DL_ENDIAN', '-DB_ENDIAN', d)} \ > - -DTERMIO ${FULL_OPTIMIZATION} -Wall" > - > -# Avoid binaries being marked as requiring an executable stack (which causes > -# issues with SELinux on the host) > -CFLAG_append_virtclass-native = " -Wa,--noexecstack" > + -DTERMIO ${FULL_OPTIMIZATION} -Wall -Wa,--noexecstack" > > # -02 does not work on mipsel: ssh hangs when it tries to read /dev/urandom > CFLAG_mtx-1 := "${@'${CFLAG}'.replace('-O2', '')}" Enrico, Thanks so much for these patches, the recipe changes such as this one, binutils, perl, and x11 need to have PR bumps, can you please resubmit them with PR increments. Also, since you have so many could you use an oe-contrib branch to submit them? There may be other comments later. Thanks Sau! Thanks Sau!
Patch
diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc index 771f146..65bb671 100644 --- a/meta/recipes-connectivity/openssl/openssl.inc +++ b/meta/recipes-connectivity/openssl/openssl.inc @@ -19,11 +19,7 @@ S = "${WORKDIR}/openssl-${PV}" AR_append = " r" CFLAG = "${@base_conditional('SITEINFO_ENDIANNESS', 'le', '-DL_ENDIAN', '-DB_ENDIAN', d)} \ - -DTERMIO ${FULL_OPTIMIZATION} -Wall" - -# Avoid binaries being marked as requiring an executable stack (which causes -# issues with SELinux on the host) -CFLAG_append_virtclass-native = " -Wa,--noexecstack" + -DTERMIO ${FULL_OPTIMIZATION} -Wall -Wa,--noexecstack" # -02 does not work on mipsel: ssh hangs when it tries to read /dev/urandom CFLAG_mtx-1 := "${@'${CFLAG}'.replace('-O2', '')}"
There is no reason to disable exec-stack only for -native builds; binaries on the target will suffer from the same SELinux ACLs. OpenSSL does not use executable stack so this option can be disabled unconditionally. Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de> --- meta/recipes-connectivity/openssl/openssl.inc | 6 +----- 1 files changed, 1 insertions(+), 5 deletions(-)