* [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt
@ 2020-09-23 15:29 Matt Weber
2020-09-23 18:51 ` Thomas Petazzoni
2020-09-23 19:01 ` Matthew Weber
0 siblings, 2 replies; 4+ messages in thread
From: Matt Weber @ 2020-09-23 15:29 UTC (permalink / raw)
To: buildroot
PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
runtime code generation to generate the PLT stubs. Secure-PLT was
introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
Binutils 2.17), and is a more secure PLT format, using a read-only
linkage table, with the dynamic linker populating a non-executable
index table.
Ref to other distro/BSD transitions
https://patchwork.openembedded.org/patch/106621/
https://reviews.freebsd.org/D20598
Fixes a bug observed when creating SELinux policy where all apps
require execmem because the heap requires execute before this
change.
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
---
package/gcc/gcc.mk | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/package/gcc/gcc.mk b/package/gcc/gcc.mk
index b834269adc..df5bf22b96 100644
--- a/package/gcc/gcc.mk
+++ b/package/gcc/gcc.mk
@@ -223,6 +223,13 @@ HOST_GCC_COMMON_CONF_OPTS += \
--with-long-double-128
endif
+# Set default to Secure-PLT to prevent run-time
+# generation of PLT stubs (supports RELRO and
+# SELinux non-exemem capabilities)
+ifeq ($(BR2_powerpc),y)
+HOST_GCC_COMMON_CONF_OPTS += --enable-secureplt
+endif
+
# PowerPC64 big endian by default uses the elfv1 ABI, and PowerPC 64
# little endian by default uses the elfv2 ABI. However, musl has
# decided to use the elfv2 ABI for both, so we force the elfv2 ABI for
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt
2020-09-23 15:29 [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt Matt Weber
@ 2020-09-23 18:51 ` Thomas Petazzoni
2020-09-23 19:01 ` Matthew Weber
1 sibling, 0 replies; 4+ messages in thread
From: Thomas Petazzoni @ 2020-09-23 18:51 UTC (permalink / raw)
To: buildroot
On Wed, 23 Sep 2020 10:29:08 -0500
Matt Weber <matthew.weber@rockwellcollins.com> wrote:
> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
> runtime code generation to generate the PLT stubs. Secure-PLT was
> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
> Binutils 2.17), and is a more secure PLT format, using a read-only
> linkage table, with the dynamic linker populating a non-executable
> index table.
>
> Ref to other distro/BSD transitions
> https://patchwork.openembedded.org/patch/106621/
> https://reviews.freebsd.org/D20598
>
> Fixes a bug observed when creating SELinux policy where all apps
> require execmem because the heap requires execute before this
> change.
>
> Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
> ---
> package/gcc/gcc.mk | 7 +++++++
> 1 file changed, 7 insertions(+)
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt
2020-09-23 15:29 [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt Matt Weber
2020-09-23 18:51 ` Thomas Petazzoni
@ 2020-09-23 19:01 ` Matthew Weber
2020-09-29 19:09 ` Peter Korsgaard
1 sibling, 1 reply; 4+ messages in thread
From: Matthew Weber @ 2020-09-23 19:01 UTC (permalink / raw)
To: buildroot
Peter,
On Wed, Sep 23, 2020 at 10:29 AM Matt Weber
<matthew.weber@rockwellcollins.com> wrote:
>
> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
> runtime code generation to generate the PLT stubs. Secure-PLT was
> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
> Binutils 2.17), and is a more secure PLT format, using a read-only
> linkage table, with the dynamic linker populating a non-executable
> index table.
>
> Ref to other distro/BSD transitions
> https://patchwork.openembedded.org/patch/106621/
> https://reviews.freebsd.org/D20598
>
> Fixes a bug observed when creating SELinux policy where all apps
> require execmem because the heap requires execute before this
> change.
>
This also applies to 2020.02.x and the previous release 2020.08.
Best Regards,
Matt
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt
2020-09-23 19:01 ` Matthew Weber
@ 2020-09-29 19:09 ` Peter Korsgaard
0 siblings, 0 replies; 4+ messages in thread
From: Peter Korsgaard @ 2020-09-29 19:09 UTC (permalink / raw)
To: buildroot
>>>>> "Matthew" == Matthew Weber <matthew.weber@rockwellcollins.com> writes:
> Peter,
> On Wed, Sep 23, 2020 at 10:29 AM Matt Weber
> <matthew.weber@rockwellcollins.com> wrote:
>>
>> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
>> runtime code generation to generate the PLT stubs. Secure-PLT was
>> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
>> Binutils 2.17), and is a more secure PLT format, using a read-only
>> linkage table, with the dynamic linker populating a non-executable
>> index table.
>>
>> Ref to other distro/BSD transitions
>> https://patchwork.openembedded.org/patch/106621/
>> https://reviews.freebsd.org/D20598
>>
>> Fixes a bug observed when creating SELinux policy where all apps
>> require execmem because the heap requires execute before this
>> change.
>>
> This also applies to 2020.02.x and the previous release 2020.08.
Committed to 2020.02.x, 2020.05.x and 2020.08.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-09-29 19:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-23 15:29 [Buildroot] [PATCH] gcc: powerpc32 transition to secureplt Matt Weber
2020-09-23 18:51 ` Thomas Petazzoni
2020-09-23 19:01 ` Matthew Weber
2020-09-29 19:09 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.