openssl: build always with -Wa,--noexecstack

Submitted by Enrico Scholz on Jan. 12, 2012, 4:30 p.m.

Details

Message ID 1326385824-32201-2-git-send-email-enrico.scholz@sigma-chemnitz.de
State New
Headers show

Commit Message

Enrico Scholz Jan. 12, 2012, 4:30 p.m.
There is no reason to disable exec-stack only for -native builds;
binaries on the target will suffer from the same SELinux ACLs.

OpenSSL does not use executable stack so this option can be disabled
unconditionally.

Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
---
 meta/recipes-connectivity/openssl/openssl.inc |    6 +-----
 1 files changed, 1 insertions(+), 5 deletions(-)

Patch hide | download patch | download mbox

diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc
index 771f146..65bb671 100644
--- a/meta/recipes-connectivity/openssl/openssl.inc
+++ b/meta/recipes-connectivity/openssl/openssl.inc
@@ -19,11 +19,7 @@  S = "${WORKDIR}/openssl-${PV}"
 
 AR_append = " r"
 CFLAG = "${@base_conditional('SITEINFO_ENDIANNESS', 'le', '-DL_ENDIAN', '-DB_ENDIAN', d)} \
-	-DTERMIO ${FULL_OPTIMIZATION} -Wall"
-
-# Avoid binaries being marked as requiring an executable stack (which causes 
-# issues with SELinux on the host)
-CFLAG_append_virtclass-native = " -Wa,--noexecstack"
+	-DTERMIO ${FULL_OPTIMIZATION} -Wall -Wa,--noexecstack"
 
 # -02 does not work on mipsel: ssh hangs when it tries to read /dev/urandom
 CFLAG_mtx-1 := "${@'${CFLAG}'.replace('-O2', '')}"

Comments

Saul Wold Jan. 12, 2012, 8:58 p.m.
On 01/12/2012 08:30 AM, Enrico Scholz wrote:
> There is no reason to disable exec-stack only for -native builds;
> binaries on the target will suffer from the same SELinux ACLs.
>
> OpenSSL does not use executable stack so this option can be disabled
> unconditionally.
>
> Signed-off-by: Enrico Scholz<enrico.scholz@sigma-chemnitz.de>
> ---
>   meta/recipes-connectivity/openssl/openssl.inc |    6 +-----
>   1 files changed, 1 insertions(+), 5 deletions(-)
>
> diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc
> index 771f146..65bb671 100644
> --- a/meta/recipes-connectivity/openssl/openssl.inc
> +++ b/meta/recipes-connectivity/openssl/openssl.inc
> @@ -19,11 +19,7 @@ S = "${WORKDIR}/openssl-${PV}"
>
>   AR_append = " r"
>   CFLAG = "${@base_conditional('SITEINFO_ENDIANNESS', 'le', '-DL_ENDIAN', '-DB_ENDIAN', d)} \
> -	-DTERMIO ${FULL_OPTIMIZATION} -Wall"
> -
> -# Avoid binaries being marked as requiring an executable stack (which causes
> -# issues with SELinux on the host)
> -CFLAG_append_virtclass-native = " -Wa,--noexecstack"
> +	-DTERMIO ${FULL_OPTIMIZATION} -Wall -Wa,--noexecstack"
>
>   # -02 does not work on mipsel: ssh hangs when it tries to read /dev/urandom
>   CFLAG_mtx-1 := "${@'${CFLAG}'.replace('-O2', '')}"

Enrico,

Thanks so much for these patches, the recipe changes such as this one, 
binutils, perl, and x11 need to have PR bumps, can you please resubmit 
them with PR increments.

Also, since you have so many could you use an oe-contrib branch to 
submit them?

There may be other comments later.

Thanks
	Sau!

Thanks
	Sau!