freebsd-ports/Mk/bsd.ssp.mk

# $FreeBSD$
# SSP Support

SSP_Include_MAINTAINER=	portmgr@FreeBSD.org

.if !defined(SSP_UNSAFE) && \
    (${MACHINE} != "mips")
# Overridable as a user may want to use -fstack-protector-all
SSP_CFLAGS?=	-fstack-protector-strong
CFLAGS+=	${SSP_CFLAGS}
LDFLAGS+=	${SSP_CFLAGS}
.endif
SSP support has been added to ports with WITH_SSP for i386 and amd64 on FreeBSD 10, and amd64 on earlier versions. SSP_UNSAFE is added to disable in a port if it fails to build, but this should only be used in rare circumstances such as kernel modules. Otherwise, the port may just be failing due to lack of respecting LDFLAGS. On FreeBSD 10, this uses an ldscript in /usr/lib/libc.so to pull in libssp_nonshared.a to address issues linking on i386 [1]. On earlier FreeBSD versions the WITH_SSP knob will add -lssp_nonshared to LDFLAGS on i386. This is not needed on amd64. However, several hundred ports do not currently respect LDFLAGS, so this support is disabled currently as it causes build failures if a dependency is looking for the stack_chk symbols. Many thanks to jlh@ for this as he had many years of patience in getting all of the necessary pieces [1][2] in. [1] http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup PR: ports/138228 [2] Submitted by: jlh (bsd.ssp.mk based on) Reviewed by: bapt With hat: portmgr exp-runs done: 37 over a month on 91i386,91amd64,10i386,10amd64 2013-09-20 14:54:54 +02:00			`# $FreeBSD$`
			`# SSP Support`

			`SSP_Include_MAINTAINER= portmgr@FreeBSD.org`

- Enable SSP by default. This is the culmination of years of work and testing including work by jlh@. This will enable SSP by default for all amd64 releases, and i386 releases 10.0 and over. With hat: portmgr Tested by: multiple exp-runs, CFT package repository, CFT ports Discussed with: bapt, antoine 2014-11-02 21:01:31 +01:00			`.if !defined(SSP_UNSAFE) && \`
Switch to -fstack-protector-strong and enable on more architectures PR: 237273 Exp-run by: antoine Approved by: portmgr (antoine) Differential Revision: https://reviews.freebsd.org/D19907 2019-04-24 21:15:05 +02:00			`(${MACHINE} != "mips")`
SSP support has been added to ports with WITH_SSP for i386 and amd64 on FreeBSD 10, and amd64 on earlier versions. SSP_UNSAFE is added to disable in a port if it fails to build, but this should only be used in rare circumstances such as kernel modules. Otherwise, the port may just be failing due to lack of respecting LDFLAGS. On FreeBSD 10, this uses an ldscript in /usr/lib/libc.so to pull in libssp_nonshared.a to address issues linking on i386 [1]. On earlier FreeBSD versions the WITH_SSP knob will add -lssp_nonshared to LDFLAGS on i386. This is not needed on amd64. However, several hundred ports do not currently respect LDFLAGS, so this support is disabled currently as it causes build failures if a dependency is looking for the stack_chk symbols. Many thanks to jlh@ for this as he had many years of patience in getting all of the necessary pieces [1][2] in. [1] http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup PR: ports/138228 [2] Submitted by: jlh (bsd.ssp.mk based on) Reviewed by: bapt With hat: portmgr exp-runs done: 37 over a month on 91i386,91amd64,10i386,10amd64 2013-09-20 14:54:54 +02:00			`# Overridable as a user may want to use -fstack-protector-all`
Switch to -fstack-protector-strong and enable on more architectures PR: 237273 Exp-run by: antoine Approved by: portmgr (antoine) Differential Revision: https://reviews.freebsd.org/D19907 2019-04-24 21:15:05 +02:00			`SSP_CFLAGS?= -fstack-protector-strong`
No need to expand CFLAGS/LDFLAGS here. With hat: portmgr 2014-08-16 23:18:49 +02:00			`CFLAGS+= ${SSP_CFLAGS}`
Switch to -fstack-protector-strong and enable on more architectures PR: 237273 Exp-run by: antoine Approved by: portmgr (antoine) Differential Revision: https://reviews.freebsd.org/D19907 2019-04-24 21:15:05 +02:00			`LDFLAGS+= ${SSP_CFLAGS}`
SSP support has been added to ports with WITH_SSP for i386 and amd64 on FreeBSD 10, and amd64 on earlier versions. SSP_UNSAFE is added to disable in a port if it fails to build, but this should only be used in rare circumstances such as kernel modules. Otherwise, the port may just be failing due to lack of respecting LDFLAGS. On FreeBSD 10, this uses an ldscript in /usr/lib/libc.so to pull in libssp_nonshared.a to address issues linking on i386 [1]. On earlier FreeBSD versions the WITH_SSP knob will add -lssp_nonshared to LDFLAGS on i386. This is not needed on amd64. However, several hundred ports do not currently respect LDFLAGS, so this support is disabled currently as it causes build failures if a dependency is looking for the stack_chk symbols. Many thanks to jlh@ for this as he had many years of patience in getting all of the necessary pieces [1][2] in. [1] http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup PR: ports/138228 [2] Submitted by: jlh (bsd.ssp.mk based on) Reviewed by: bapt With hat: portmgr exp-runs done: 37 over a month on 91i386,91amd64,10i386,10amd64 2013-09-20 14:54:54 +02:00			`.endif`