Turn on -D_FORTIFY_SOURCE=2 by default plus other security enhancements
commit86ab04a28039a697c950e6db77f0685549fca9a0
authorMatías Fonzo <selk@dragora.org>
Mon, 8 Feb 2021 13:33:47 +0000 (8 10:33 -0300)
committerMatías Fonzo <selk@dragora.org>
Mon, 8 Feb 2021 13:33:47 +0000 (8 10:33 -0300)
tree88a36c70b6bf81af5db8ca43e392be99eb31546c
parent95a73bd4ce719be922226c53c96e72a8d5744a5c
Turn on -D_FORTIFY_SOURCE=2 by default plus other security enhancements

Currently QICPPFLAGS is used to pass -D_FORTIFY_SOURCE=2 to the
CPPFLAGS that are used in recipes; unfortunately, there are sources
that do not even respect or include the CPPFLAGS, others use another
name for this flag.  Anyway, we make sure to always use this measure
through the compiler.

Also, in this opportunity we have applied patches for the compiler
(Thanks to "Alpine Linux") to improve security in Dragora by default.

Signed-off-by: Matías Fonzo <selk@dragora.org>
27 files changed:
patches/gcc/0004-Turn-on-D_FORTIFY_SOURCE-2-by-default-for-C-C-ObjC-O.patch [new file with mode: 0644]
patches/gcc/0005-On-linux-targets-pass-as-needed-by-default-to-the-li.patch [new file with mode: 0644]
patches/gcc/0006-Enable-Wformat-and-Wformat-security-by-default.patch [new file with mode: 0644]
patches/gcc/0007-Enable-Wtrampolines-by-default.patch [new file with mode: 0644]
patches/gcc/0008-Disable-ssp-on-nostdlib-nodefaultlibs-and-ffreestand.patch [new file with mode: 0644]
patches/gcc/0020-add-fortify-headers-paths.patch [new file with mode: 0644]
patches/gcc/0022-DP-Use-push-state-pop-state-for-gold-as-well-when-li.patch [new file with mode: 0644]
patches/mlocate/01-fortify-source-compat.patch [new file with mode: 0644]
recipes/00-core.order
recipes/03-xorg.order
recipes/compressors/clzip/recipe
recipes/devel/gcc/recipe
recipes/kernel/fortify-headers/recipe [new file with mode: 0644]
recipes/kernel/headers/recipe
recipes/libs/lzlib/recipe
recipes/lua/lua5/recipe
recipes/ruby/ruby3/recipe
recipes/shells/mksh/recipe
recipes/tools/mlocate/recipe
recipes/tools/tarlz/recipe
recipes/xorg/app/sessreg/recipe
recipes/xorg/app/xload/recipe
recipes/xorg/mesa/recipe
sources/SOURCELIST.txt
sources/fortify-headers-1.1.tar.gz.sha256 [new file with mode: 0644]
stages/1/03-fortify-headers [new file with mode: 0755]
stages/1/05-gcc