Core OS Index

2.2.3. Toolchain

Add flags to pkgmk configuration and change specific ports that don't build with hardening flags. More information about arch security, gentoo security, gcc instrumentation-options and glibc configuring and compiling. Edit /etc/pkgmk.conf;

        export CPPFLAGS="-D_FORTIFY_SOURCE=2"
        export CFLAGS="-O2 -march=native -mtune=native -fstack-protector-strong --param=ssp-buffer-size=4"
        export CXXFLAGS="${CFLAGS}"
        export LDFLAGS="-z relro"
        

Core

Ports in core collection that need to be changed in order to build with pkgmk harden configuration.

Glibc

        export CPPFLAGS=""
        export CFLAGS="-O2 -march=native -mtune=native"
        export CXXFLAGS="${CFLAGS}"
        export LDFLAGS=""
        
        ../$name-${version:0:4}/configure --prefix=/usr \
                --libexecdir=/usr/lib \
                --with-headers=$PKG/usr/include \
                --enable-kernel=3.12 \
                --enable-add-ons \
                --enable-static-nss \
                --disable-profile \
                --disable-werror \
                --without-gd \
                --enable-obsolete-rpc \
                --enable-multi-arch \
                --enable-stackguard-randomization \
                --enable-stack-protector=strong
        

Gcc

        export CPPFLAGS=""
        export CFLAGS="-O2 -march=native -mtune=native"
        export CXXFLAGS="${CFLAGS}"
        export LDFLAGS=""
        

Openssl

Replace openssl by libressl, view if libressl port from 6c37-dropin is updated with latest libressl upstream. First install libressl to ensure it gets all the sources;

        $ sudo prt-get depinst libressl
        

After complaining about openssl files remove openssl;

        $ sudo prt-get remove openssl
        $ sudo prt-get depinst libressl
        

libcap

bzip2

hdparm

Opt

lsof

python

zip

glew

dmenu

Boost

        export CPPFLAGS=""
        export CFLAGS="-O2 -march=native -mtune=native"
        export CXXFLAGS="${CFLAGS}"
        export LDFLAGS=""
        

Contrib

gsl

Core OS Index

This is part of the Hive System Documentation. Copyright (C) 2018 c9 team. See the file Gnu Free Documentation License for copying conditions.