profiles: security: Add the security profile

Add security compiler options.

- Enable the hardened-ld-pie.specs and -fPIC CFLAG (48f2de33d3/include/hardened-ld-pie.specs):
CONFIG_BUSYBOX_DEFAULT_PIE=y
CONFIG_PKG_ASLR_PIE_ALL=y

- Add -fstack-protector-strong to CFLAGS:
CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y
CONFIG_KERNEL_CC_STACKPROTECTOR_STRONG=y

- Add -D_FORTIFY_SOURCE=2 to CFLAGS:
CONFIG_PKG_FORTIFY_SOURCE_2=y

- Add the -fPIE option to gcc:
CONFIG_TOOLCHAINOPTS=y
CONFIG_GCC_DEFAULT_PIE=y

Add the same time enable this by default for the CI builds

References: PCF-880

Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [rebased]

.gitlab-ci.yml

@@ -31,52 +31,52 @@ stages:
   - cdrouter
   - coverity
 
-build test mxl_x86 mxl_wlan_hostap_ng prpl:
+build test mxl_x86 mxl_wlan_hostap_ng prpl security:
   image: registry.gitlab.com/prpl-foundation/prplos/prplos/prplos-next/builder-osp@sha256:c3e7d58f4ca821b78386da1a36c8a9646805cdc5b746500464411c245b95d049
   extends: .build test config
   artifacts:
   tags:
     - firmware-builder-osp
 
-build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl:
+build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl security:
   image: registry.gitlab.com/prpl-foundation/prplos/prplos/prplos-next/builder-osp@sha256:c3e7d58f4ca821b78386da1a36c8a9646805cdc5b746500464411c245b95d049
   extends: .build test config
   artifacts:
   tags:
     - firmware-builder-osp
 
-build test mvebu prpl:
+build test mvebu prpl security:
   extends: .build test config
 
-build test x86_64 prpl:
+build test x86_64 prpl security:
   extends: .build test config
   variables:
     CI_BUILD_CONFIG: >
       +DEVEL +BUILD_LOG +SDK +IB +IB_STANDALONE
 
-build test ipq807x prpl:
+build test ipq807x prpl security:
   extends: .build test config
 
 run test Turris Omnia initramfs:
   needs:
-    - job: build test mvebu prpl
+    - job: build test mvebu prpl security
       optional: true
   extends: .turris-omnia testbed
 
 run test Haze initramfs:
   needs:
-    - job: build test ipq807x prpl
+    - job: build test ipq807x prpl security
       optional: true
   extends: .prpl-haze testbed
 
 run test URX851-HDK-3 with system on eMMC:
   needs:
-    - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl
+    - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl security
       optional: true
   extends: .urx851-hdk-3 testbed
 
 run test URX851-B0-DK-PON with system on eMMC:
   needs:
-    - job: build test mxl_x86 mxl_wlan_hostap_ng prpl
+    - job: build test mxl_x86 mxl_wlan_hostap_ng prpl security
       optional: true
   extends: .urx851-b0-dk-pon testbed

.gitlab/cdrouter/glinet-b1300.yml

@@ -1,6 +1,6 @@
 .glinet-cdrouter: &glinet_cdrouter
   needs:
-    - job: build test ipq40xx prpl
+    - job: build test ipq40xx prpl security
       optional: true
   extends:
     - .glinet-b1300 testbed

.gitlab/cdrouter/prpl-haze.yml

@@ -1,6 +1,6 @@
 .prpl-haze: &prpl_haze
   needs:
-    - job: build test ipq807x prpl
+    - job: build test ipq807x prpl security
       optional: true
   extends:
     - .prpl-haze testbed

.gitlab/cdrouter/turris-omnia.yml

@@ -1,6 +1,6 @@
 .turris-cdrouter: &turris_cdrouter
   needs:
-    - job: build test mvebu prpl
+    - job: build test mvebu prpl security
       optional: true
   extends:
     - .turris-omnia testbed

.gitlab/cdrouter/urx851-b0-dk-pon.yml

@@ -1,6 +1,6 @@
 .urx851-pon-cdrouter: &urx851_pon_cdrouter
   needs:
-    - job: build test mxl_x86 mxl_wlan_hostap_ng prpl
+    - job: build test mxl_x86 mxl_wlan_hostap_ng prpl security
       optional: true
   extends:
     - .urx851-b0-dk-pon testbed

.gitlab/cdrouter/urx851-hdk-3.yml

@@ -1,6 +1,6 @@
 .urx851-cdrouter: &urx851_cdrouter
   needs:
-    - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl
+    - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl security
       optional: true
   extends:
     - .urx851-hdk-3 testbed

.gitlab/docker/sdk/gitlab.yml

@@ -1,6 +1,6 @@
 build Docker image sdk-mvebu-cortexa9:
   stage: docker SDK
-  needs: ["build test mvebu prpl"]
+  needs: ["build test mvebu prpl security"]
   variables:
     DOCKER_DOCKERFILE_PATH: .gitlab/docker/sdk
     DOCKER_BUILD_EXTRA_ARGS: --build-arg DESIGNATED_BRANCH=$CI_DESIGNATED_BRANCH
@@ -20,7 +20,7 @@ deploy Docker image sdk-mvebu-cortexa9:
 
 build Docker image sdk-x86-64:
   stage: docker SDK
-  needs: ["build test x86_64 prpl"]
+  needs: ["build test x86_64 prpl security"]
   variables:
     DOCKER_DOCKERFILE_PATH: .gitlab/docker/sdk
     DOCKER_BUILD_EXTRA_ARGS: --build-arg DESIGNATED_BRANCH=$CI_DESIGNATED_BRANCH
@@ -40,7 +40,7 @@ deploy Docker image sdk-x86-64:
 
 build Docker image sdk-ipq807x-generic:
   stage: docker SDK
-  needs: ["build test ipq807x prpl"]
+  needs: ["build test ipq807x prpl security"]
   variables:
     DOCKER_DOCKERFILE_PATH: .gitlab/docker/sdk
     DOCKER_BUILD_EXTRA_ARGS: --build-arg DESIGNATED_BRANCH=$CI_DESIGNATED_BRANCH

profiles/security.yml

@@ -0,0 +1,10 @@
+---
+description: Add compiler security features
+diffconfig: |
+          CONFIG_BUSYBOX_DEFAULT_PIE=y
+          CONFIG_GCC_DEFAULT_PIE=y
+          CONFIG_KERNEL_CC_STACKPROTECTOR_STRONG=y
+          CONFIG_PKG_ASLR_PIE_ALL=y
+          CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y
+          CONFIG_PKG_FORTIFY_SOURCE_2=y
+          CONFIG_TOOLCHAINOPTS=y