config/Config-build.in

   1 # Copyright (C) 2006-2013 OpenWrt.org
   2 # Copyright (C) 2016 LEDE Project
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 config EXPERIMENTAL
   9         bool "Enable experimental features by default"
  10         default n
  11         help
  12           Set this option to build with latest bleeding edge features
  13           which may or may not work as expected.
  14           If you would like to help the development of OpenWrt, you are
  15           encouraged to set this option and provide feedback (both
  16           positive and negative). But do so only if you know how to
  17           recover your device in case of flashing potentially non-working
  18           firmware.
  19
  20           If you plan to use this build in production, say NO!
  21
  22 menu "Global build settings"
  23
  24         config JSON_OVERVIEW_IMAGE_INFO
  25                 bool "Create JSON info file overview per target"
  26                 default BUILDBOT
  27                 help
  28                   Create a JSON info file called profiles.json in the target
  29                   directory containing machine readable list of built profiles
  30                   and resulting images.
  31
  32         config ALL_NONSHARED
  33                 bool "Select all target specific packages by default"
  34                 select ALL_KMODS
  35                 default BUILDBOT
  36
  37         config ALL_KMODS
  38                 bool "Select all kernel module packages by default"
  39
  40         config ALL
  41                 bool "Select all userspace packages by default"
  42                 select ALL_KMODS
  43                 select ALL_NONSHARED
  44
  45         config BUILDBOT
  46                 bool "Set build defaults for automatic builds (e.g. via buildbot)"
  47                 default n
  48                 help
  49                   This option changes several defaults to be more suitable for
  50                   automatic builds. This includes the following changes:
  51                   - Deleting build directories after compiling (to save space)
  52                   - Enabling per-device rootfs support
  53                   ...
  54
  55         config SIGNED_PACKAGES
  56                 bool "Cryptographically signed package lists"
  57                 default y
  58
  59         config SIGNATURE_CHECK
  60                 bool "Enable signature checking in opkg"
  61                 default SIGNED_PACKAGES
  62
  63         comment "General build options"
  64
  65         config TESTING_KERNEL
  66                 bool "Use the testing kernel version"
  67                 depends on HAS_TESTING_KERNEL
  68                 default EXPERIMENTAL
  69                 help
  70                   If the target supports a newer kernel version than the default,
  71                   you can use this config option to enable it
  72
  73
  74         config DISPLAY_SUPPORT
  75                 bool "Show packages that require graphics support (local or remote)"
  76                 default n
  77
  78         config BUILD_PATENTED
  79                 default n
  80                 bool "Compile with support for patented functionality"
  81                 help
  82                   When this option is disabled, software which provides patented functionality
  83                   will not be built.  In case software provides optional support for patented
  84                   functionality, this optional support will get disabled for this package.
  85
  86         config BUILD_NLS
  87                 default n
  88                 bool "Compile with full language support"
  89                 help
  90                   When this option is enabled, packages are built with the full versions of
  91                   iconv and GNU gettext instead of the default OpenWrt stubs. If uClibc is
  92                   used, it is also built with locale support.
  93
  94         config SHADOW_PASSWORDS
  95                 bool
  96                 default y
  97
  98         config CLEAN_IPKG
  99                 bool
 100                 prompt "Remove ipkg/opkg status data files in final images"
 101                 default n
 102                 help
 103                   This removes all ipkg/opkg status data files from the target directory
 104                   before building the root filesystem.
 105
 106         config IPK_FILES_CHECKSUMS
 107                 bool
 108                 prompt "Record files checksums in package metadata"
 109                 default n
 110                 help
 111                   This makes file checksums part of package metadata. It increases size
 112                   but provides you with pkg_check command to check for flash coruptions.
 113
 114         config INCLUDE_CONFIG
 115                 bool "Include build configuration in firmware" if DEVEL
 116                 default n
 117                 help
 118                   If enabled, buildinfo files will be stored in /etc/build.* of firmware.
 119
 120         config REPRODUCIBLE_DEBUG_INFO
 121                 bool "Make debug information reproducible"
 122                 default BUILDBOT
 123                 help
 124                   This strips the local build path out of debug information. This has the
 125                   advantage of making it reproducible, but the disadvantage of making local
 126                   debugging using ./scripts/remote-gdb harder, since the debug data will
 127                   no longer point to the full path on the build host.
 128
 129         config COLLECT_KERNEL_DEBUG
 130                 bool
 131                 prompt "Collect kernel debug information"
 132                 select KERNEL_DEBUG_INFO
 133                 default BUILDBOT
 134                 help
 135                   This collects debugging symbols from the kernel and all compiled modules.
 136                   Useful for release builds, so that kernel issues can be debugged offline
 137                   later.
 138
 139         menu "Kernel build options"
 140
 141         source "config/Config-kernel.in"
 142
 143         endmenu
 144
 145         comment "Package build options"
 146
 147         config DEBUG
 148                 bool
 149                 prompt "Compile packages with debugging info"
 150                 default n
 151                 help
 152                   Adds -g3 to the CFLAGS.
 153
 154         config IPV6
 155                 bool
 156                 prompt "Enable IPv6 support in packages"
 157                 default y
 158                 help
 159                   Enables IPv6 support in kernel (builtin) and packages.
 160
 161         comment "Stripping options"
 162
 163         choice
 164                 prompt "Binary stripping method"
 165                 default USE_STRIP   if EXTERNAL_TOOLCHAIN
 166                 default USE_STRIP   if USE_GLIBC
 167                 default USE_SSTRIP
 168                 help
 169                   Select the binary stripping method you wish to use.
 170
 171                 config NO_STRIP
 172                         bool "none"
 173                         help
 174                           This will install unstripped binaries (useful for native
 175                           compiling/debugging).
 176
 177                 config USE_STRIP
 178                         bool "strip"
 179                         help
 180                           This will install binaries stripped using strip from binutils.
 181
 182
 183                 config USE_SSTRIP
 184                         bool "sstrip"
 185                         depends on !USE_GLIBC
 186                         help
 187                           This will install binaries stripped using sstrip.
 188         endchoice
 189
 190         config STRIP_ARGS
 191                 string
 192                 prompt "Strip arguments"
 193                 depends on USE_STRIP
 194                 default "--strip-unneeded --remove-section=.comment --remove-section=.note" if DEBUG
 195                 default "--strip-all"
 196                 help
 197                   Specifies arguments passed to the strip command when stripping binaries.
 198
 199         config SSTRIP_ARGS
 200                 string
 201                 prompt "Sstrip arguments"
 202                 depends on USE_SSTRIP
 203                 default "-z"
 204                 help
 205                   Specifies arguments passed to the sstrip command when stripping binaries.
 206
 207         config STRIP_KERNEL_EXPORTS
 208                 bool "Strip unnecessary exports from the kernel image"
 209                 help
 210                   Reduces kernel size by stripping unused kernel exports from the kernel
 211                   image.  Note that this might make the kernel incompatible with any kernel
 212                   modules that were not selected at the time the kernel image was created.
 213
 214         config USE_MKLIBS
 215                 bool "Strip unnecessary functions from libraries"
 216                 help
 217                   Reduces libraries to only those functions that are necessary for using all
 218                   selected packages (including those selected as <M>).  Note that this will
 219                   make the system libraries incompatible with most of the packages that are
 220                   not selected during the build process.
 221
 222         choice
 223                 prompt "Preferred standard C++ library"
 224                 default USE_LIBSTDCXX if USE_GLIBC
 225                 default USE_UCLIBCXX
 226                 help
 227                   Select the preferred standard C++ library for all packages that support this.
 228
 229                 config USE_UCLIBCXX
 230                         bool "uClibc++"
 231
 232                 config USE_LIBSTDCXX
 233                         bool "libstdc++"
 234         endchoice
 235
 236         comment "Hardening build options"
 237
 238         config PKG_CHECK_FORMAT_SECURITY
 239                 bool
 240                 prompt "Enable gcc format-security"
 241                 default y
 242                 help
 243                   Add -Wformat -Werror=format-security to the CFLAGS.  You can disable
 244                   this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
 245                   Makefile.
 246
 247         choice
 248                 prompt "User space ASLR PIE compilation"
 249                 default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK)
 250                 default PKG_ASLR_PIE_REGULAR
 251                 help
 252                   Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
 253                   This enables package build as Position Independent Executables (PIE)
 254                   to protect against "return-to-text" attacks. This belongs to the
 255                   feature of Address Space Layout Randomisation (ASLR), which is
 256                   implemented by the kernel and the ELF loader by randomising the
 257                   location of memory allocations. This makes memory addresses harder
 258                   to predict when an attacker is attempting a memory-corruption exploit.
 259                   You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
 260                   Makefile.
 261                   Be ware that ASLR increases the binary size.
 262                 config PKG_ASLR_PIE_NONE
 263                         bool "None"
 264                         help
 265                           PIE is deactivated for all applications
 266                 config PKG_ASLR_PIE_REGULAR
 267                         bool "Regular"
 268                         help
 269                           PIE is activated for some binaries, mostly network exposed applications
 270                 config PKG_ASLR_PIE_ALL
 271                         bool "All"
 272                         select BUSYBOX_DEFAULT_PIE
 273                         help
 274                           PIE is activated for all applications
 275         endchoice
 276
 277         choice
 278                 prompt "User space Stack-Smashing Protection"
 279                 default PKG_CC_STACKPROTECTOR_REGULAR
 280                 help
 281                   Enable GCC Stack Smashing Protection (SSP) for userspace applications
 282                 config PKG_CC_STACKPROTECTOR_NONE
 283                         bool "None"
 284                 config PKG_CC_STACKPROTECTOR_REGULAR
 285                         bool "Regular"
 286                 config PKG_CC_STACKPROTECTOR_STRONG
 287                         bool "Strong"
 288         endchoice
 289
 290         choice
 291                 prompt "Kernel space Stack-Smashing Protection"
 292                 default KERNEL_CC_STACKPROTECTOR_REGULAR
 293                 help
 294                   Enable GCC Stack-Smashing Protection (SSP) for the kernel
 295                 config KERNEL_CC_STACKPROTECTOR_NONE
 296                         bool "None"
 297                 config KERNEL_CC_STACKPROTECTOR_REGULAR
 298                         bool "Regular"
 299                 config KERNEL_CC_STACKPROTECTOR_STRONG
 300                         bool "Strong"
 301         endchoice
 302
 303         config KERNEL_STACKPROTECTOR
 304                 bool
 305                 default KERNEL_CC_STACKPROTECTOR_REGULAR || KERNEL_CC_STACKPROTECTOR_STRONG
 306
 307         config KERNEL_STACKPROTECTOR_STRONG
 308                 bool
 309                 default KERNEL_CC_STACKPROTECTOR_STRONG
 310
 311         choice
 312                 prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)"
 313                 default PKG_FORTIFY_SOURCE_1
 314                 help
 315                   Enable the _FORTIFY_SOURCE macro which introduces additional
 316                   checks to detect buffer-overflows in the following standard library
 317                   functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy,
 318                   strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf,
 319                   gets.  "Conservative" (_FORTIFY_SOURCE set to 1) only introduces
 320                   checks that shouldn't change the behavior of conforming programs,
 321                   while "aggressive" (_FORTIFY_SOURCES set to 2) some more checking is
 322                   added, but some conforming programs might fail.
 323                 config PKG_FORTIFY_SOURCE_NONE
 324                         bool "None"
 325                 config PKG_FORTIFY_SOURCE_1
 326                         bool "Conservative"
 327                 config PKG_FORTIFY_SOURCE_2
 328                         bool "Aggressive"
 329         endchoice
 330
 331         choice
 332                 prompt "Enable RELRO protection"
 333                 default PKG_RELRO_FULL
 334                 help
 335                   Enable a link-time protection known as RELRO (Relocation Read Only)
 336                   which helps to protect from certain type of exploitation techniques
 337                   altering the content of some ELF sections. "Partial" RELRO makes the
 338                   .dynamic section not writeable after initialization, introducing
 339                   almost no performance penalty, while "full" RELRO also marks the GOT
 340                   as read-only at the cost of initializing all of it at startup.
 341                 config PKG_RELRO_NONE
 342                         bool "None"
 343                 config PKG_RELRO_PARTIAL
 344                         bool "Partial"
 345                 config PKG_RELRO_FULL
 346                         bool "Full"
 347         endchoice
 348
 349         config TARGET_ROOTFS_SECURITY_LABELS
 350                 bool
 351                 select KERNEL_SQUASHFS_XATTR
 352                 select KERNEL_EXT4_FS_SECURITY
 353                 select KERNEL_F2FS_FS_SECURITY
 354                 select KERNEL_UBIFS_FS_SECURITY
 355                 select KERNEL_JFFS2_FS_SECURITY
 356
 357         config SELINUX
 358                 bool "Enable SELinux"
 359                 select KERNEL_SECURITY_SELINUX
 360                 select TARGET_ROOTFS_SECURITY_LABELS
 361                 select PACKAGE_procd-selinux
 362                 select PACKAGE_busybox-selinux
 363                 help
 364                   This option enables SELinux kernel features, applies security labels
 365                   in squashfs rootfs and selects the selinux-variants of busybox and procd.
 366
 367                   Selecting this option results in about 0.5MiB of additional flash space
 368                   usage accounting for increased kernel and rootfs size.
 369
 370         choice
 371                 prompt "default SELinux type"
 372                 depends on TARGET_ROOTFS_SECURITY_LABELS
 373                 default SELINUXTYPE_dssp
 374                 help
 375                   Select SELinux policy to be installed and used for applying rootfs labels.
 376
 377                 config SELINUXTYPE_targeted
 378                         bool "targeted"
 379                         select PACKAGE_refpolicy
 380                         help
 381                           SELinux Reference Policy (refpolicy)
 382
 383                 config SELINUXTYPE_dssp
 384                         bool "dssp"
 385                         select PACKAGE_selinux-policy
 386                         help
 387                           Defensec SELinux Security Policy -- OpenWrt edition
 388
 389         endchoice
 390
 391 endmenu