Linus, All,
On 2013-12-31 16:16 -0800, Linus Torvalds spake thusly:
> On Mon, Dec 30, 2013 at 4:45 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> >
> > NAK. If you have selected CONFIG_CC_STACKPROTECTOR_STRONG, the build
> > the fail hard. Without this, it means you'll end up with kernels that
> > build and show a stackprotector option in their config, which is
> > false.
>
> What we really really want to do is to have some way to add config
> options based on shell scripts and compiler support. That would also
> get rid of a lot of Makefile trickery etc.
>
> Then we could just make CC_STACKPROTECTOR_STRONG depend on
> CC_SUPPORTS_STACKPROTECTOR_STRONG or whatever.
Sam Ravnborg suggested somethink along those lines back in July:
http://marc.info/?l=linux-kbuild&m=137399785206527&w=2
and a tentative implementation:
http://marc.info/?l=linux-kbuild&m=137409581406434&w=2
Basically, that would give something like:
config CC_SUPPORTS_STACKPROTECTOR_STRONG
bool
option exec="some/script/to/test-gcc -fstack-protector-strong"
config CC_STACKPROTECTOR_STRONG
bool "enable stack-protector strong"
depends on CC_SUPPORTS_STACKPROTECTOR_STRONG
Would that be something that match what you suggested above?
Sam, there were some comments on that patch of yours. Do you want to
update it and resubmit it?
And, Happy New Year to All!
Regards,
Yann E. MORIN.
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
