[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openembedded-core
Subject:    Re: [OE-core] [PATCH] defaultsetup.conf: Enable security flags+pie by default
From:       Peter Kjellerstedt <peter.kjellerstedt () axis ! com>
Date:       2018-07-31 21:17:24
Message-ID: fd53f53f0589472397e5657990e9e5d8 () XBOX02 ! axis ! com
[Download RAW message or body]

> -----Original Message-----
> From: Khem Raj <raj.khem@gmail.com>
> Sent: den 27 juli 2018 23:27
> To: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
> Cc: ChenQi <Qi.Chen@windriver.com>; Patches and discussions about the
> oe-core layer <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security
> flags+pie by default
> 
> On Fri, Jul 27, 2018 at 1:49 PM Peter Kjellerstedt
> <peter.kjellerstedt@axis.com> wrote:
> >
> > > -----Original Message-----
> > > From: openembedded-core-bounces@lists.openembedded.org
> <openembedded-
> > > core-bounces@lists.openembedded.org> On Behalf Of Khem Raj
> > > Sent: den 24 juli 2018 16:12
> > > To: ChenQi <Qi.Chen@windriver.com>
> > > Cc: Patches and discussions about the oe-core layer <openembedded-
> > > core@lists.openembedded.org>
> > > Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security
> > > flags+pie by default
> > >
> > > On Tue, Jul 24, 2018 at 12:30 AM ChenQi <Qi.Chen@windriver.com>
> wrote:
> > > >
> > > > Hi Khem,
> > > >
> > > > The comments in security-flags.inc also needs to be modified to
> > > remove
> > > > 'poky-lsb' info.
> > > >
> > > > I'd suggest we still put it into distro conf file (poky.conf)
> instead
> > > of
> > > > defaultsetup.conf, because defaultsetup.conf is included by
> > > > bitbake.conf. I think things in defaultsetup.conf should be
> necessary
> > > > default values to build things out. I don't think security flags
> is
> > > > necessary to build things out.
> > >
> > > this is the default setup, even non-poky users will get consistent
> > > experience.
> >
> > I have to agree with Chen here. I think requiring security_flags.inc
> from
> > defaultsetup.conf is the wrong thing to do. We use security_flags.inc
> in
> > our setup, and I know how much trouble it has brought. To me, using
> it
> > should be a distro decision, not something that is enforced by the
> use
> > of bitbake.
> 
> Thats fine, I can move this to poky distro settings, using it by
> default would have
> been in sync for all since reference distro is using it would be
> easier for others when
> submitting patches, as a phase 2 I was also thinking of defaulting to
> hardeing in the toolchain itself
> and remove this file completely that would have made it much better,
> then folks who dont want hardeing could just disable
> it in toolchain. but I am fine to leave it a distro decision for now.

I do not think that relying on the toolchain to handle this is the 
right thing to do, given that some of us use external toolchains in 
addition to the toolchain from OE-Core... With the current setup we 
get roughly the same coverage regardless of which toolchain we use.

//Peter

-- 
_______________________________________________
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core
[prev in list] [next in list] [prev in thread] [next in thread]