mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 07:38:10 +00:00
7188d4637e
This is useful when using nolibc for security-critical tools. Using nolibc has the advantage that the code is easily auditable and sandboxable with seccomp as no unexpected syscalls are used. Using compiler-assistent stack protection provides another security mechanism. For this to work the compiler and libc have to collaborate. This patch adds the following parts to nolibc that are required by the compiler: * __stack_chk_guard: random sentinel value * __stack_chk_fail: handler for detected stack smashes In addition an initialization function is added that randomizes the sentinel value. Only support for global guards is implemented. Register guards are useful in multi-threaded context which nolibc does not provide support for. Link: https://lwn.net/Articles/584225/ Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
75 lines
2.4 KiB
Makefile
75 lines
2.4 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
# Makefile for nolibc installation and tests
|
|
include ../../scripts/Makefile.include
|
|
|
|
# we're in ".../tools/include/nolibc"
|
|
ifeq ($(srctree),)
|
|
srctree := $(patsubst %/tools/include/,%,$(dir $(CURDIR)))
|
|
endif
|
|
|
|
# when run as make -C tools/ nolibc_<foo> the arch is not set
|
|
ifeq ($(ARCH),)
|
|
include $(srctree)/scripts/subarch.include
|
|
ARCH = $(SUBARCH)
|
|
endif
|
|
|
|
# OUTPUT is only set when run from the main makefile, otherwise
|
|
# it defaults to this nolibc directory.
|
|
OUTPUT ?= $(CURDIR)/
|
|
|
|
ifeq ($(V),1)
|
|
Q=
|
|
else
|
|
Q=@
|
|
endif
|
|
|
|
nolibc_arch := $(patsubst arm64,aarch64,$(ARCH))
|
|
arch_file := arch-$(nolibc_arch).h
|
|
all_files := ctype.h errno.h nolibc.h signal.h stackprotector.h std.h stdint.h \
|
|
stdio.h stdlib.h string.h sys.h time.h types.h unistd.h
|
|
|
|
# install all headers needed to support a bare-metal compiler
|
|
all: headers
|
|
|
|
install: help
|
|
|
|
help:
|
|
@echo "Supported targets under nolibc:"
|
|
@echo " all call \"headers\""
|
|
@echo " clean clean the sysroot"
|
|
@echo " headers prepare a sysroot in tools/include/nolibc/sysroot"
|
|
@echo " headers_standalone like \"headers\", and also install kernel headers"
|
|
@echo " help this help"
|
|
@echo ""
|
|
@echo "These targets may also be called from tools as \"make nolibc_<target>\"."
|
|
@echo ""
|
|
@echo "Currently using the following variables:"
|
|
@echo " ARCH = $(ARCH)"
|
|
@echo " OUTPUT = $(OUTPUT)"
|
|
@echo ""
|
|
|
|
# Note: when ARCH is "x86" we concatenate both x86_64 and i386
|
|
headers:
|
|
$(Q)mkdir -p $(OUTPUT)sysroot
|
|
$(Q)mkdir -p $(OUTPUT)sysroot/include
|
|
$(Q)cp $(all_files) $(OUTPUT)sysroot/include/
|
|
$(Q)if [ "$(ARCH)" = "x86" ]; then \
|
|
sed -e \
|
|
's,^#ifndef _NOLIBC_ARCH_X86_64_H,#if !defined(_NOLIBC_ARCH_X86_64_H) \&\& defined(__x86_64__),' \
|
|
arch-x86_64.h; \
|
|
sed -e \
|
|
's,^#ifndef _NOLIBC_ARCH_I386_H,#if !defined(_NOLIBC_ARCH_I386_H) \&\& !defined(__x86_64__),' \
|
|
arch-i386.h; \
|
|
elif [ -e "$(arch_file)" ]; then \
|
|
cat $(arch_file); \
|
|
else \
|
|
echo "Fatal: architecture $(ARCH) not yet supported by nolibc." >&2; \
|
|
exit 1; \
|
|
fi > $(OUTPUT)sysroot/include/arch.h
|
|
|
|
headers_standalone: headers
|
|
$(Q)$(MAKE) -C $(srctree) headers
|
|
$(Q)$(MAKE) -C $(srctree) headers_install INSTALL_HDR_PATH=$(OUTPUT)sysroot
|
|
|
|
clean:
|
|
$(call QUIET_CLEAN, nolibc) rm -rf "$(OUTPUT)sysroot"
|