| Message ID | 20200923152908.21153-1-matthew.weber@rockwellcollins.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | gcc: powerpc32 transition to secureplt | expand |
On Wed, 23 Sep 2020 10:29:08 -0500 Matt Weber <matthew.weber@rockwellcollins.com> wrote: > PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses > runtime code generation to generate the PLT stubs. Secure-PLT was > introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and > Binutils 2.17), and is a more secure PLT format, using a read-only > linkage table, with the dynamic linker populating a non-executable > index table. > > Ref to other distro/BSD transitions > https://patchwork.openembedded.org/patch/106621/ > https://reviews.freebsd.org/D20598 > > Fixes a bug observed when creating SELinux policy where all apps > require execmem because the heap requires execute before this > change. > > Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> > --- > package/gcc/gcc.mk | 7 +++++++ > 1 file changed, 7 insertions(+) Applied to master, thanks. Thomas
Peter, On Wed, Sep 23, 2020 at 10:29 AM Matt Weber <matthew.weber@rockwellcollins.com> wrote: > > PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses > runtime code generation to generate the PLT stubs. Secure-PLT was > introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and > Binutils 2.17), and is a more secure PLT format, using a read-only > linkage table, with the dynamic linker populating a non-executable > index table. > > Ref to other distro/BSD transitions > https://patchwork.openembedded.org/patch/106621/ > https://reviews.freebsd.org/D20598 > > Fixes a bug observed when creating SELinux policy where all apps > require execmem because the heap requires execute before this > change. > This also applies to 2020.02.x and the previous release 2020.08. Best Regards, Matt
>>>>> "Matthew" == Matthew Weber <matthew.weber@rockwellcollins.com> writes: > Peter, > On Wed, Sep 23, 2020 at 10:29 AM Matt Weber > <matthew.weber@rockwellcollins.com> wrote: >> >> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses >> runtime code generation to generate the PLT stubs. Secure-PLT was >> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and >> Binutils 2.17), and is a more secure PLT format, using a read-only >> linkage table, with the dynamic linker populating a non-executable >> index table. >> >> Ref to other distro/BSD transitions >> https://patchwork.openembedded.org/patch/106621/ >> https://reviews.freebsd.org/D20598 >> >> Fixes a bug observed when creating SELinux policy where all apps >> require execmem because the heap requires execute before this >> change. >> > This also applies to 2020.02.x and the previous release 2020.08. Committed to 2020.02.x, 2020.05.x and 2020.08.x, thanks.
diff --git a/package/gcc/gcc.mk b/package/gcc/gcc.mk index b834269adc..df5bf22b96 100644 --- a/package/gcc/gcc.mk +++ b/package/gcc/gcc.mk @@ -223,6 +223,13 @@ HOST_GCC_COMMON_CONF_OPTS += \ --with-long-double-128 endif +# Set default to Secure-PLT to prevent run-time +# generation of PLT stubs (supports RELRO and +# SELinux non-exemem capabilities) +ifeq ($(BR2_powerpc),y) +HOST_GCC_COMMON_CONF_OPTS += --enable-secureplt +endif + # PowerPC64 big endian by default uses the elfv1 ABI, and PowerPC 64 # little endian by default uses the elfv2 ABI. However, musl has # decided to use the elfv2 ABI for both, so we force the elfv2 ABI for
PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses runtime code generation to generate the PLT stubs. Secure-PLT was introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and Binutils 2.17), and is a more secure PLT format, using a read-only linkage table, with the dynamic linker populating a non-executable index table. Ref to other distro/BSD transitions https://patchwork.openembedded.org/patch/106621/ https://reviews.freebsd.org/D20598 Fixes a bug observed when creating SELinux policy where all apps require execmem because the heap requires execute before this change. Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> --- package/gcc/gcc.mk | 7 +++++++ 1 file changed, 7 insertions(+)