Re: [gentoo-embedded] building klibc in an hardened environment

[Natanael Copa]

Kevin F. Quinn wrote:

>On 23/8/2005 9:37:13, Natanael Copa (mlists@××××××.org) wrote:
>
>
>>I am trying to build klibc in an hardened environment. The ssp causes
>>some problems. I wonder how I can turn off the ssp while compiling
>>klibc? I have tried USE="-hardened" CFLAGS="-fnostack-protector" but it
>>looks like the -fno-stackprotector option never is used. What can I do
>>to compile klibc in my hardened environment? Turning off SSP is ok. It
>>will only be used for initramfs anyway.
>>
>>
>
>USE="-hardened" won't do anything as the klibc ebuild doesn't look at the hardened
>use flag (nor should it).  I suspect that klibc is not honouring the environment
>CFLAGS - doing "CFLAGS="-fno-stack-protector" should work (note that there
>are dashes between no, stack, and protector).
>
>

It does not. That was one of the first things I tried.

>First off, file a bug on bugs.gentoo.org.
>
>

I thought it could be nice having a solution before filing a bug. I
posted here because I thought some here had been into something similar.
Does none of the hardened ppl do initramfs?

>The simple way to switch off SSP is to switch to a no-ssp compiler; do
>'gcc-config -l' to see what you have available, then use gcc-config to choose
>either the vanilla or -nossp version.  Use this version to build initramfs as
>well.  Don't forget to switch back after you've finished.
>
>

I tried that too. It didnt work.

>Obviously, anything built against klibc will also need to be built with ssp switched
>off, as you don't have the support functions for ssp in klibc.
>
>

What actually worked was to add -fno-stack-protector to REQFLAGS in MCONFIG.

I'll file a bug.
-- 
gentoo-embedded@g.o mailing list