From bdc5584b15cd2aefcbfc7e355076ede829b85fd6 Mon Sep 17 00:00:00 2001 From: Roland Hieber Date: Mon, 11 Mar 2019 00:40:38 +0100 Subject: rpi: enable gcc stack clash protection This setting was introduced in PTXdist 2019.03.0: Generate code to prevent stack clash style attacks. When this option is enabled, the compiler will only allocate one page of stack space at a time and each page is accessed immediately after allocation. Thus, it prevents allocations from jumping over any stack guard page provided by the operating system. Make use of it to get more secure binaries with gcc-8's new -fstack-clash-protection option. Signed-off-by: Roland Hieber --- configs/platform-rpi/platformconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'configs/platform-rpi/platformconfig') diff --git a/configs/platform-rpi/platformconfig b/configs/platform-rpi/platformconfig index 657fb42..d6808b5 100644 --- a/configs/platform-rpi/platformconfig +++ b/configs/platform-rpi/platformconfig @@ -80,7 +80,7 @@ PTXCONF_COMPILER_PREFIX_BOOTLOADER="${PTXCONF_COMPILER_PREFIX}" # PTXCONF_TARGET_HARDEN_STACK is not set PTXCONF_TARGET_HARDEN_STACK_STRONG=y # PTXCONF_TARGET_HARDEN_STACK_ALL is not set -# PTXCONF_TARGET_HARDEN_STACKCLASH is not set +PTXCONF_TARGET_HARDEN_STACKCLASH=y PTXCONF_TARGET_HARDEN_FORTIFY=y PTXCONF_TARGET_HARDEN_RELRO=y PTXCONF_TARGET_HARDEN_BINDNOW=y -- cgit v1.2.3