X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=config%2FConfig-build.in;h=0aaf6b31c38bd554d21305c0c397b92f22153fe7;hb=23049f9c31f030829980b7e32e424435572ae9ac;hp=e0889fcccfc29b1364861933ceaa9e8595a697a6;hpb=9dcb921d908e664655e8bde2db64640b4f2d9072;p=openwrt%2Fstaging%2Fjow.git diff --git a/config/Config-build.in b/config/Config-build.in index e0889fcccf..0aaf6b31c3 100644 --- a/config/Config-build.in +++ b/config/Config-build.in @@ -5,19 +5,42 @@ # See /LICENSE for more information. # +config EXPERIMENTAL + bool "Enable experimental features by default" + default n + help + Set this option to build with latest bleeding edge features + which may or may not work as expected. + If you would like to help the development of OpenWrt, you are + encouraged to set this option and provide feedback (both + positive and negative). But do so only if you know how to + recover your device in case of flashing potentially non-working + firmware. + + If you plan to use this build in production, say NO! + menu "Global build settings" + config JSON_OVERVIEW_IMAGE_INFO + bool "Create JSON info file overview per target" + default BUILDBOT + help + Create a JSON info file called profiles.json in the target + directory containing machine readable list of built profiles + and resulting images. + config ALL_NONSHARED bool "Select all target specific packages by default" - default ALL || BUILDBOT + select ALL_KMODS + default BUILDBOT config ALL_KMODS bool "Select all kernel module packages by default" - default ALL config ALL bool "Select all userspace packages by default" - default n + select ALL_KMODS + select ALL_NONSHARED config BUILDBOT bool "Set build defaults for automatic builds (e.g. via buildbot)" @@ -33,14 +56,27 @@ menu "Global build settings" bool "Cryptographically signed package lists" default y + config SIGNATURE_CHECK + bool "Enable signature checking in opkg" + default SIGNED_PACKAGES + comment "General build options" + config TESTING_KERNEL + bool "Use the testing kernel version" + depends on HAS_TESTING_KERNEL + default EXPERIMENTAL + help + If the target supports a newer kernel version than the default, + you can use this config option to enable it + + config DISPLAY_SUPPORT bool "Show packages that require graphics support (local or remote)" default n config BUILD_PATENTED - default y + default n bool "Compile with support for patented functionality" help When this option is disabled, software which provides patented functionality @@ -67,6 +103,29 @@ menu "Global build settings" This removes all ipkg/opkg status data files from the target directory before building the root filesystem. + config IPK_FILES_CHECKSUMS + bool + prompt "Record files checksums in package metadata" + default n + help + This makes file checksums part of package metadata. It increases size + but provides you with pkg_check command to check for flash coruptions. + + config INCLUDE_CONFIG + bool "Include build configuration in firmware" if DEVEL + default n + help + If enabled, buildinfo files will be stored in /etc/build.* of firmware. + + config REPRODUCIBLE_DEBUG_INFO + bool "Make debug information reproducible" + default BUILDBOT + help + This strips the local build path out of debug information. This has the + advantage of making it reproducible, but the disadvantage of making local + debugging using ./scripts/remote-gdb harder, since the debug data will + no longer point to the full path on the build host. + config COLLECT_KERNEL_DEBUG bool prompt "Collect kernel debug information" @@ -77,10 +136,12 @@ menu "Global build settings" Useful for release builds, so that kernel issues can be debugged offline later. - comment "Kernel build options" + menu "Kernel build options" source "config/Config-kernel.in" + endmenu + comment "Package build options" config DEBUG @@ -135,6 +196,14 @@ menu "Global build settings" help Specifies arguments passed to the strip command when stripping binaries. + config SSTRIP_ARGS + string + prompt "Sstrip arguments" + depends on USE_SSTRIP + default "-z" + help + Specifies arguments passed to the sstrip command when stripping binaries. + config STRIP_KERNEL_EXPORTS bool "Strip unnecessary exports from the kernel image" help @@ -175,9 +244,38 @@ menu "Global build settings" this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package Makefile. + choice + prompt "User space ASLR PIE compilation" + default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK) + default PKG_ASLR_PIE_REGULAR + help + Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS. + This enables package build as Position Independent Executables (PIE) + to protect against "return-to-text" attacks. This belongs to the + feature of Address Space Layout Randomisation (ASLR), which is + implemented by the kernel and the ELF loader by randomising the + location of memory allocations. This makes memory addresses harder + to predict when an attacker is attempting a memory-corruption exploit. + You can disable this per package by adding PKG_ASLR_PIE:=0 in the package + Makefile. + Be ware that ASLR increases the binary size. + config PKG_ASLR_PIE_NONE + bool "None" + help + PIE is deactivated for all applications + config PKG_ASLR_PIE_REGULAR + bool "Regular" + help + PIE is activated for some binaries, mostly network exposed applications + config PKG_ASLR_PIE_ALL + bool "All" + select BUSYBOX_DEFAULT_PIE + help + PIE is activated for all applications + endchoice + choice prompt "User space Stack-Smashing Protection" - depends on USE_MUSL default PKG_CC_STACKPROTECTOR_REGULAR help Enable GCC Stack Smashing Protection (SSP) for userspace applications @@ -185,19 +283,13 @@ menu "Global build settings" bool "None" config PKG_CC_STACKPROTECTOR_REGULAR bool "Regular" - select SSP_SUPPORT if !USE_MUSL - depends on KERNEL_CC_STACKPROTECTOR_REGULAR config PKG_CC_STACKPROTECTOR_STRONG bool "Strong" - select SSP_SUPPORT if !USE_MUSL - depends on !GCC_VERSION_4_8 - depends on KERNEL_CC_STACKPROTECTOR_STRONG endchoice choice prompt "Kernel space Stack-Smashing Protection" default KERNEL_CC_STACKPROTECTOR_REGULAR - depends on USE_MUSL || !(x86_64 || i386) help Enable GCC Stack-Smashing Protection (SSP) for the kernel config KERNEL_CC_STACKPROTECTOR_NONE @@ -205,10 +297,17 @@ menu "Global build settings" config KERNEL_CC_STACKPROTECTOR_REGULAR bool "Regular" config KERNEL_CC_STACKPROTECTOR_STRONG - depends on !GCC_VERSION_4_8 bool "Strong" endchoice + config KERNEL_STACKPROTECTOR + bool + default KERNEL_CC_STACKPROTECTOR_REGULAR || KERNEL_CC_STACKPROTECTOR_STRONG + + config KERNEL_STACKPROTECTOR_STRONG + bool + default KERNEL_CC_STACKPROTECTOR_STRONG + choice prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)" default PKG_FORTIFY_SOURCE_1 @@ -247,4 +346,46 @@ menu "Global build settings" bool "Full" endchoice + config TARGET_ROOTFS_SECURITY_LABELS + bool + select KERNEL_SQUASHFS_XATTR + select KERNEL_EXT4_FS_SECURITY + select KERNEL_F2FS_FS_SECURITY + select KERNEL_UBIFS_FS_SECURITY + select KERNEL_JFFS2_FS_SECURITY + + config SELINUX + bool "Enable SELinux" + select KERNEL_SECURITY_SELINUX + select TARGET_ROOTFS_SECURITY_LABELS + select PACKAGE_procd-selinux + select PACKAGE_busybox-selinux + help + This option enables SELinux kernel features, applies security labels + in squashfs rootfs and selects the selinux-variants of busybox and procd. + + Selecting this option results in about 0.5MiB of additional flash space + usage accounting for increased kernel and rootfs size. + + choice + prompt "default SELinux type" + depends on TARGET_ROOTFS_SECURITY_LABELS + default SELINUXTYPE_dssp + help + Select SELinux policy to be installed and used for applying rootfs labels. + + config SELINUXTYPE_targeted + bool "targeted" + select PACKAGE_refpolicy + help + SELinux Reference Policy (refpolicy) + + config SELINUXTYPE_dssp + bool "dssp" + select PACKAGE_selinux-policy + help + Defensec SELinux Security Policy -- OpenWrt edition + + endchoice + endmenu