build: add hardened builds with PIE (ASLR) support

[openwrt/staging/luka.git] / config / Config-build.in

diff --git a/config/Config-build.in b/config/Config-build.in
index 7ec7653a9ab708230a1a51c8210369de642120ea..660da1c47f4d676cea5110c15dd89eda23f577c7 100644 (file)
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -184,6 +184,22 @@ menu "Global build settings"
                  this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
                  Makefile.
 
+       config PKG_ASLR_PIE
+               bool
+               prompt "User space ASLR PIE compilation"
+               select BUSYBOX_DEFAULT_PIE
+               default n
+               help
+                 Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
+                 This enables package build as Position Independent Executables (PIE)
+                 to protect against "return-to-text" attacks. This belongs to the
+                 feature of Address Space Layout Randomisation (ASLR), which is
+                 implemented by the kernel and the ELF loader by randomising the
+                 location of memory allocations. This makes memory addresses harder
+                 to predict when an attacker is attempting a memory-corruption exploit.
+                 You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
+                 Makefile.
+
        choice
                prompt "User space Stack-Smashing Protection"
                depends on USE_MUSL