Re: [PATCH] defaultsetup.conf: Enable security flags+pie by default

[Khem Raj <raj.khem@gmail.com>]

On Tue, Jul 31, 2018 at 2:17 PM Peter Kjellerstedt
<peter.kjellerstedt@axis.com> wrote:
>
> > -----Original Message-----
> > From: Khem Raj <raj.khem@gmail.com>
> > Sent: den 27 juli 2018 23:27
> > To: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
> > Cc: ChenQi <Qi.Chen@windriver.com>; Patches and discussions about the
> > oe-core layer <openembedded-core@lists.openembedded.org>
> > Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security
> > flags+pie by default
> >
> > On Fri, Jul 27, 2018 at 1:49 PM Peter Kjellerstedt
> > <peter.kjellerstedt@axis.com> wrote:
> > >
> > > > -----Original Message-----
> > > > From: openembedded-core-bounces@lists.openembedded.org
> > <openembedded-
> > > > core-bounces@lists.openembedded.org> On Behalf Of Khem Raj
> > > > Sent: den 24 juli 2018 16:12
> > > > To: ChenQi <Qi.Chen@windriver.com>
> > > > Cc: Patches and discussions about the oe-core layer <openembedded-
> > > > core@lists.openembedded.org>
> > > > Subject: Re: [OE-core] [PATCH] defaultsetup.conf: Enable security
> > > > flags+pie by default
> > > >
> > > > On Tue, Jul 24, 2018 at 12:30 AM ChenQi <Qi.Chen@windriver.com>
> > wrote:
> > > > >
> > > > > Hi Khem,
> > > > >
> > > > > The comments in security-flags.inc also needs to be modified to
> > > > remove
> > > > > 'poky-lsb' info.
> > > > >
> > > > > I'd suggest we still put it into distro conf file (poky.conf)
> > instead
> > > > of
> > > > > defaultsetup.conf, because defaultsetup.conf is included by
> > > > > bitbake.conf. I think things in defaultsetup.conf should be
> > necessary
> > > > > default values to build things out. I don't think security flags
> > is
> > > > > necessary to build things out.
> > > >
> > > > this is the default setup, even non-poky users will get consistent
> > > > experience.
> > >
> > > I have to agree with Chen here. I think requiring security_flags.inc
> > from
> > > defaultsetup.conf is the wrong thing to do. We use security_flags.inc
> > in
> > > our setup, and I know how much trouble it has brought. To me, using
> > it
> > > should be a distro decision, not something that is enforced by the
> > use
> > > of bitbake.
> >
> > Thats fine, I can move this to poky distro settings, using it by
> > default would have
> > been in sync for all since reference distro is using it would be
> > easier for others when
> > submitting patches, as a phase 2 I was also thinking of defaulting to
> > hardeing in the toolchain itself
> > and remove this file completely that would have made it much better,
> > then folks who dont want hardeing could just disable
> > it in toolchain. but I am fine to leave it a distro decision for now.
>
> I do not think that relying on the toolchain to handle this is the
> right thing to do, given that some of us use external toolchains in
> addition to the toolchain from OE-Core... With the current setup we
> get roughly the same coverage regardless of which toolchain we use.

conversely,
external toolchains can then include unsecure-flags.inc or some such file
IMO we should provide best experience out of box for internal toolchain users
since thats all what we can do effectively. If we were to switch
defaults to use hardened flags
then it will be much better to have toolchains default to it and
thereby we can remove
many patches which we carry to inject these flags artificially in many
recipes confusing the
component build systems especially when dealing with PIE and PIC and
shared objects