From de35c3c7d48e13340e7eb985bc5879d5fd42eedb Mon Sep 17 00:00:00 2001 From: Matthias FRANCK Date: Tue, 11 Apr 2023 13:25:38 +0200 Subject: [PATCH] profiles: security: Add the security profile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add security compiler options. - Enable the hardened-ld-pie.specs and -fPIC CFLAG (https://gitlab.com/prpl-foundation/prplos/prplos/-/blob/48f2de33d34a7daf457d9ba54853ca83eca5f118/include/hardened-ld-pie.specs): CONFIG_BUSYBOX_DEFAULT_PIE=y CONFIG_PKG_ASLR_PIE_ALL=y - Add -fstack-protector-strong to CFLAGS: CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y CONFIG_KERNEL_CC_STACKPROTECTOR_STRONG=y - Add -D_FORTIFY_SOURCE=2 to CFLAGS: CONFIG_PKG_FORTIFY_SOURCE_2=y - Add the -fPIE option to gcc: CONFIG_TOOLCHAINOPTS=y CONFIG_GCC_DEFAULT_PIE=y Add the same time enable this by default for the CI builds References: PCF-880 Signed-off-by: Matthias FRANCK Signed-off-by: Petr Štetiar [rebased] --- .gitlab-ci.yml | 18 +++++++++--------- .gitlab/cdrouter/glinet-b1300.yml | 2 +- .gitlab/cdrouter/prpl-haze.yml | 2 +- .gitlab/cdrouter/turris-omnia.yml | 2 +- .gitlab/cdrouter/urx851-b0-dk-pon.yml | 2 +- .gitlab/cdrouter/urx851-hdk-3.yml | 2 +- .gitlab/docker/sdk/gitlab.yml | 6 +++--- profiles/security.yml | 10 ++++++++++ 8 files changed, 27 insertions(+), 17 deletions(-) create mode 100644 profiles/security.yml diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7210513a64..183e509b61 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -31,52 +31,52 @@ stages: - cdrouter - coverity -build test mxl_x86 mxl_wlan_hostap_ng prpl: +build test mxl_x86 mxl_wlan_hostap_ng prpl security: image: registry.gitlab.com/prpl-foundation/prplos/prplos/prplos-next/builder-osp@sha256:c3e7d58f4ca821b78386da1a36c8a9646805cdc5b746500464411c245b95d049 extends: .build test config artifacts: tags: - firmware-builder-osp -build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl: +build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl security: image: registry.gitlab.com/prpl-foundation/prplos/prplos/prplos-next/builder-osp@sha256:c3e7d58f4ca821b78386da1a36c8a9646805cdc5b746500464411c245b95d049 extends: .build test config artifacts: tags: - firmware-builder-osp -build test mvebu prpl: +build test mvebu prpl security: extends: .build test config -build test x86_64 prpl: +build test x86_64 prpl security: extends: .build test config variables: CI_BUILD_CONFIG: > +DEVEL +BUILD_LOG +SDK +IB +IB_STANDALONE -build test ipq807x prpl: +build test ipq807x prpl security: extends: .build test config run test Turris Omnia initramfs: needs: - - job: build test mvebu prpl + - job: build test mvebu prpl security optional: true extends: .turris-omnia testbed run test Haze initramfs: needs: - - job: build test ipq807x prpl + - job: build test ipq807x prpl security optional: true extends: .prpl-haze testbed run test URX851-HDK-3 with system on eMMC: needs: - - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl + - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl security optional: true extends: .urx851-hdk-3 testbed run test URX851-B0-DK-PON with system on eMMC: needs: - - job: build test mxl_x86 mxl_wlan_hostap_ng prpl + - job: build test mxl_x86 mxl_wlan_hostap_ng prpl security optional: true extends: .urx851-b0-dk-pon testbed diff --git a/.gitlab/cdrouter/glinet-b1300.yml b/.gitlab/cdrouter/glinet-b1300.yml index 9f01c44873..82c5f6cd64 100644 --- a/.gitlab/cdrouter/glinet-b1300.yml +++ b/.gitlab/cdrouter/glinet-b1300.yml @@ -1,6 +1,6 @@ .glinet-cdrouter: &glinet_cdrouter needs: - - job: build test ipq40xx prpl + - job: build test ipq40xx prpl security optional: true extends: - .glinet-b1300 testbed diff --git a/.gitlab/cdrouter/prpl-haze.yml b/.gitlab/cdrouter/prpl-haze.yml index 507639828e..3c3d2413e6 100644 --- a/.gitlab/cdrouter/prpl-haze.yml +++ b/.gitlab/cdrouter/prpl-haze.yml @@ -1,6 +1,6 @@ .prpl-haze: &prpl_haze needs: - - job: build test ipq807x prpl + - job: build test ipq807x prpl security optional: true extends: - .prpl-haze testbed diff --git a/.gitlab/cdrouter/turris-omnia.yml b/.gitlab/cdrouter/turris-omnia.yml index 83bfdf4b8f..f7c6ceb0ac 100644 --- a/.gitlab/cdrouter/turris-omnia.yml +++ b/.gitlab/cdrouter/turris-omnia.yml @@ -1,6 +1,6 @@ .turris-cdrouter: &turris_cdrouter needs: - - job: build test mvebu prpl + - job: build test mvebu prpl security optional: true extends: - .turris-omnia testbed diff --git a/.gitlab/cdrouter/urx851-b0-dk-pon.yml b/.gitlab/cdrouter/urx851-b0-dk-pon.yml index a5ac1f6029..edced06e2a 100644 --- a/.gitlab/cdrouter/urx851-b0-dk-pon.yml +++ b/.gitlab/cdrouter/urx851-b0-dk-pon.yml @@ -1,6 +1,6 @@ .urx851-pon-cdrouter: &urx851_pon_cdrouter needs: - - job: build test mxl_x86 mxl_wlan_hostap_ng prpl + - job: build test mxl_x86 mxl_wlan_hostap_ng prpl security optional: true extends: - .urx851-b0-dk-pon testbed diff --git a/.gitlab/cdrouter/urx851-hdk-3.yml b/.gitlab/cdrouter/urx851-hdk-3.yml index ae36a199af..64a9758467 100644 --- a/.gitlab/cdrouter/urx851-hdk-3.yml +++ b/.gitlab/cdrouter/urx851-hdk-3.yml @@ -1,6 +1,6 @@ .urx851-cdrouter: &urx851_cdrouter needs: - - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl + - job: build test mxl_x86_osp_tb341 mxl_wlan_hostap_ng prpl security optional: true extends: - .urx851-hdk-3 testbed diff --git a/.gitlab/docker/sdk/gitlab.yml b/.gitlab/docker/sdk/gitlab.yml index 867146abc5..66e0186fc1 100644 --- a/.gitlab/docker/sdk/gitlab.yml +++ b/.gitlab/docker/sdk/gitlab.yml @@ -1,6 +1,6 @@ build Docker image sdk-mvebu-cortexa9: stage: docker SDK - needs: ["build test mvebu prpl"] + needs: ["build test mvebu prpl security"] variables: DOCKER_DOCKERFILE_PATH: .gitlab/docker/sdk DOCKER_BUILD_EXTRA_ARGS: --build-arg DESIGNATED_BRANCH=$CI_DESIGNATED_BRANCH @@ -20,7 +20,7 @@ deploy Docker image sdk-mvebu-cortexa9: build Docker image sdk-x86-64: stage: docker SDK - needs: ["build test x86_64 prpl"] + needs: ["build test x86_64 prpl security"] variables: DOCKER_DOCKERFILE_PATH: .gitlab/docker/sdk DOCKER_BUILD_EXTRA_ARGS: --build-arg DESIGNATED_BRANCH=$CI_DESIGNATED_BRANCH @@ -40,7 +40,7 @@ deploy Docker image sdk-x86-64: build Docker image sdk-ipq807x-generic: stage: docker SDK - needs: ["build test ipq807x prpl"] + needs: ["build test ipq807x prpl security"] variables: DOCKER_DOCKERFILE_PATH: .gitlab/docker/sdk DOCKER_BUILD_EXTRA_ARGS: --build-arg DESIGNATED_BRANCH=$CI_DESIGNATED_BRANCH diff --git a/profiles/security.yml b/profiles/security.yml new file mode 100644 index 0000000000..c9a2a80ed1 --- /dev/null +++ b/profiles/security.yml @@ -0,0 +1,10 @@ +--- +description: Add compiler security features +diffconfig: | + CONFIG_BUSYBOX_DEFAULT_PIE=y + CONFIG_GCC_DEFAULT_PIE=y + CONFIG_KERNEL_CC_STACKPROTECTOR_STRONG=y + CONFIG_PKG_ASLR_PIE_ALL=y + CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y + CONFIG_PKG_FORTIFY_SOURCE_2=y + CONFIG_TOOLCHAINOPTS=y