config/Config-build.in

   1 # Copyright (C) 2006-2013 OpenWrt.org
   2 # Copyright (C) 2016 LEDE Project
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 menu "Global build settings"
   9
  10         config ALL_NONSHARED
  11                 bool "Select all target specific packages by default"
  12                 select ALL_KMODS
  13                 default BUILDBOT
  14
  15         config ALL_KMODS
  16                 bool "Select all kernel module packages by default"
  17
  18         config ALL
  19                 bool "Select all userspace packages by default"
  20                 select ALL_KMODS
  21                 select ALL_NONSHARED
  22
  23         config BUILDBOT
  24                 bool "Set build defaults for automatic builds (e.g. via buildbot)"
  25                 default n
  26                 help
  27                   This option changes several defaults to be more suitable for
  28                   automatic builds. This includes the following changes:
  29                   - Deleting build directories after compiling (to save space)
  30                   - Enabling per-device rootfs support
  31                   ...
  32
  33         config SIGNED_PACKAGES
  34                 bool "Cryptographically signed package lists"
  35                 default y
  36
  37         config SIGNATURE_CHECK
  38                 bool "Enable signature checking in opkg"
  39                 default SIGNED_PACKAGES
  40
  41         comment "General build options"
  42
  43         config DISPLAY_SUPPORT
  44                 bool "Show packages that require graphics support (local or remote)"
  45                 default n
  46
  47         config BUILD_PATENTED
  48                 default n
  49                 bool "Compile with support for patented functionality"
  50                 help
  51                   When this option is disabled, software which provides patented functionality
  52                   will not be built.  In case software provides optional support for patented
  53                   functionality, this optional support will get disabled for this package.
  54
  55         config BUILD_NLS
  56                 default n
  57                 bool "Compile with full language support"
  58                 help
  59                   When this option is enabled, packages are built with the full versions of
  60                   iconv and GNU gettext instead of the default OpenWrt stubs. If uClibc is
  61                   used, it is also built with locale support.
  62
  63         config SHADOW_PASSWORDS
  64                 bool
  65                 default y
  66
  67         config CLEAN_IPKG
  68                 bool
  69                 prompt "Remove ipkg/opkg status data files in final images"
  70                 default n
  71                 help
  72                   This removes all ipkg/opkg status data files from the target directory
  73                   before building the root filesystem.
  74
  75         config INCLUDE_CONFIG
  76                 bool "Include build configuration in firmware" if DEVEL
  77                 default n
  78                 help
  79                   If enabled, config.seed will be stored in /etc/build.config of firmware.
  80
  81         config COLLECT_KERNEL_DEBUG
  82                 bool
  83                 prompt "Collect kernel debug information"
  84                 select KERNEL_DEBUG_INFO
  85                 default BUILDBOT
  86                 help
  87                   This collects debugging symbols from the kernel and all compiled modules.
  88                   Useful for release builds, so that kernel issues can be debugged offline
  89                   later.
  90
  91         menu "Kernel build options"
  92
  93         source "config/Config-kernel.in"
  94
  95         endmenu
  96
  97         comment "Package build options"
  98
  99         config DEBUG
 100                 bool
 101                 prompt "Compile packages with debugging info"
 102                 default n
 103                 help
 104                   Adds -g3 to the CFLAGS.
 105
 106         config IPV6
 107                 bool
 108                 prompt "Enable IPv6 support in packages"
 109                 default y
 110                 help
 111                   Enables IPv6 support in kernel (builtin) and packages.
 112
 113         comment "Stripping options"
 114
 115         choice
 116                 prompt "Binary stripping method"
 117                 default USE_STRIP   if EXTERNAL_TOOLCHAIN
 118                 default USE_STRIP   if USE_GLIBC
 119                 default USE_SSTRIP
 120                 help
 121                   Select the binary stripping method you wish to use.
 122
 123                 config NO_STRIP
 124                         bool "none"
 125                         help
 126                           This will install unstripped binaries (useful for native
 127                           compiling/debugging).
 128
 129                 config USE_STRIP
 130                         bool "strip"
 131                         help
 132                           This will install binaries stripped using strip from binutils.
 133
 134
 135                 config USE_SSTRIP
 136                         bool "sstrip"
 137                         depends on !USE_GLIBC
 138                         help
 139                           This will install binaries stripped using sstrip.
 140         endchoice
 141
 142         config STRIP_ARGS
 143                 string
 144                 prompt "Strip arguments"
 145                 depends on USE_STRIP
 146                 default "--strip-unneeded --remove-section=.comment --remove-section=.note" if DEBUG
 147                 default "--strip-all"
 148                 help
 149                   Specifies arguments passed to the strip command when stripping binaries.
 150
 151         config STRIP_KERNEL_EXPORTS
 152                 bool "Strip unnecessary exports from the kernel image"
 153                 help
 154                   Reduces kernel size by stripping unused kernel exports from the kernel
 155                   image.  Note that this might make the kernel incompatible with any kernel
 156                   modules that were not selected at the time the kernel image was created.
 157
 158         config USE_MKLIBS
 159                 bool "Strip unnecessary functions from libraries"
 160                 help
 161                   Reduces libraries to only those functions that are necessary for using all
 162                   selected packages (including those selected as <M>).  Note that this will
 163                   make the system libraries incompatible with most of the packages that are
 164                   not selected during the build process.
 165
 166         choice
 167                 prompt "Preferred standard C++ library"
 168                 default USE_LIBSTDCXX if USE_GLIBC
 169                 default USE_UCLIBCXX
 170                 help
 171                   Select the preferred standard C++ library for all packages that support this.
 172
 173                 config USE_UCLIBCXX
 174                         bool "uClibc++"
 175
 176                 config USE_LIBSTDCXX
 177                         bool "libstdc++"
 178         endchoice
 179
 180         comment "Hardening build options"
 181
 182         config PKG_CHECK_FORMAT_SECURITY
 183                 bool
 184                 prompt "Enable gcc format-security"
 185                 default y
 186                 help
 187                   Add -Wformat -Werror=format-security to the CFLAGS.  You can disable
 188                   this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
 189                   Makefile.
 190
 191         config PKG_ASLR_PIE
 192                 bool
 193                 prompt "User space ASLR PIE compilation"
 194                 select BUSYBOX_DEFAULT_PIE
 195                 default n
 196                 help
 197                   Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
 198                   This enables package build as Position Independent Executables (PIE)
 199                   to protect against "return-to-text" attacks. This belongs to the
 200                   feature of Address Space Layout Randomisation (ASLR), which is
 201                   implemented by the kernel and the ELF loader by randomising the
 202                   location of memory allocations. This makes memory addresses harder
 203                   to predict when an attacker is attempting a memory-corruption exploit.
 204                   You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
 205                   Makefile.
 206
 207         choice
 208                 prompt "User space Stack-Smashing Protection"
 209                 depends on USE_MUSL
 210                 default PKG_CC_STACKPROTECTOR_REGULAR
 211                 help
 212                   Enable GCC Stack Smashing Protection (SSP) for userspace applications
 213                 config PKG_CC_STACKPROTECTOR_NONE
 214                         bool "None"
 215                 config PKG_CC_STACKPROTECTOR_REGULAR
 216                         bool "Regular"
 217                         select GCC_LIBSSP if !USE_MUSL
 218                         depends on KERNEL_CC_STACKPROTECTOR_REGULAR
 219                 config PKG_CC_STACKPROTECTOR_STRONG
 220                         bool "Strong"
 221                         select GCC_LIBSSP if !USE_MUSL
 222                         depends on !GCC_VERSION_4_8
 223                         depends on KERNEL_CC_STACKPROTECTOR_STRONG
 224         endchoice
 225
 226         choice
 227                 prompt "Kernel space Stack-Smashing Protection"
 228                 default KERNEL_CC_STACKPROTECTOR_REGULAR
 229                 depends on USE_MUSL || !(x86_64 || i386)
 230                 help
 231                   Enable GCC Stack-Smashing Protection (SSP) for the kernel
 232                 config KERNEL_CC_STACKPROTECTOR_NONE
 233                         bool "None"
 234                 config KERNEL_CC_STACKPROTECTOR_REGULAR
 235                         bool "Regular"
 236                 config KERNEL_CC_STACKPROTECTOR_STRONG
 237                         depends on !GCC_VERSION_4_8
 238                         bool "Strong"
 239         endchoice
 240
 241         choice
 242                 prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)"
 243                 default PKG_FORTIFY_SOURCE_1
 244                 help
 245                   Enable the _FORTIFY_SOURCE macro which introduces additional
 246                   checks to detect buffer-overflows in the following standard library
 247                   functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy,
 248                   strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf,
 249                   gets.  "Conservative" (_FORTIFY_SOURCE set to 1) only introduces
 250                   checks that shouldn't change the behavior of conforming programs,
 251                   while "aggressive" (_FORTIFY_SOURCES set to 2) some more checking is
 252                   added, but some conforming programs might fail.
 253                 config PKG_FORTIFY_SOURCE_NONE
 254                         bool "None"
 255                 config PKG_FORTIFY_SOURCE_1
 256                         bool "Conservative"
 257                 config PKG_FORTIFY_SOURCE_2
 258                         bool "Aggressive"
 259         endchoice
 260
 261         choice
 262                 prompt "Enable RELRO protection"
 263                 default PKG_RELRO_FULL
 264                 help
 265                   Enable a link-time protection known as RELRO (Relocation Read Only)
 266                   which helps to protect from certain type of exploitation techniques
 267                   altering the content of some ELF sections. "Partial" RELRO makes the
 268                   .dynamic section not writeable after initialization, introducing
 269                   almost no performance penalty, while "full" RELRO also marks the GOT
 270                   as read-only at the cost of initializing all of it at startup.
 271                 config PKG_RELRO_NONE
 272                         bool "None"
 273                 config PKG_RELRO_PARTIAL
 274                         bool "Partial"
 275                 config PKG_RELRO_FULL
 276                         bool "Full"
 277         endchoice
 278
 279 endmenu