menu "Global build settings"
+ config JSON_ADD_IMAGE_INFO
+ bool "Create JSON info files per build image"
+ default BUILDBOT
+ help
+ The JSON info files contain information about the device and
+ build images, stored next to the firmware images.
+
config ALL_NONSHARED
bool "Select all target specific packages by default"
- default ALL
+ select ALL_KMODS
+ default BUILDBOT
config ALL_KMODS
bool "Select all kernel module packages by default"
- default ALL
config ALL
bool "Select all userspace packages by default"
+ select ALL_KMODS
+ select ALL_NONSHARED
+
+ config BUILDBOT
+ bool "Set build defaults for automatic builds (e.g. via buildbot)"
default n
+ help
+ This option changes several defaults to be more suitable for
+ automatic builds. This includes the following changes:
+ - Deleting build directories after compiling (to save space)
+ - Enabling per-device rootfs support
+ ...
config SIGNED_PACKAGES
bool "Cryptographically signed package lists"
default y
+ config SIGNATURE_CHECK
+ bool "Enable signature checking in opkg"
+ default SIGNED_PACKAGES
+
comment "General build options"
+ config TESTING_KERNEL
+ bool "Use the testing kernel version"
+ depends on HAS_TESTING_KERNEL
+ default n
+ help
+ If the target supports a newer kernel version than the default,
+ you can use this config option to enable it
+
+
config DISPLAY_SUPPORT
bool "Show packages that require graphics support (local or remote)"
default n
config BUILD_PATENTED
- default y
+ default n
bool "Compile with support for patented functionality"
help
When this option is disabled, software which provides patented functionality
config SHADOW_PASSWORDS
bool
- prompt "Enable shadow password support"
default y
- help
- Enable shadow password support.
config CLEAN_IPKG
bool
This removes all ipkg/opkg status data files from the target directory
before building the root filesystem.
+ config IPK_FILES_CHECKSUMS
+ bool
+ prompt "Record files checksums in package metadata"
+ default n
+ help
+ This makes file checksums part of package metadata. It increases size
+ but provides you with pkg_check command to check for flash coruptions.
+
+ config INCLUDE_CONFIG
+ bool "Include build configuration in firmware" if DEVEL
+ default n
+ help
+ If enabled, config.buildinfo will be stored in /etc/build.config of firmware.
+
config COLLECT_KERNEL_DEBUG
bool
prompt "Collect kernel debug information"
select KERNEL_DEBUG_INFO
- default n
+ default BUILDBOT
help
This collects debugging symbols from the kernel and all compiled modules.
Useful for release builds, so that kernel issues can be debugged offline
later.
- comment "Kernel build options"
+ menu "Kernel build options"
source "config/Config-kernel.in"
+ endmenu
+
comment "Package build options"
config DEBUG
help
Enables IPv6 support in kernel (builtin) and packages.
- config PKG_BUILD_PARALLEL
- bool
- prompt "Compile certain packages parallelized"
- default y
- help
- This adds a -jX option to certain packages that are known to behave well
- for parallel build. By default, the package make processes use the main
- jobserver, in which case this option only takes effect when you add -jX
- to the make command.
-
- If you are unsure, select N.
-
- config PKG_BUILD_USE_JOBSERVER
- bool
- prompt "Use top-level make jobserver for packages"
- depends on PKG_BUILD_PARALLEL
- default y
- help
- This passes the main make process jobserver fds to package builds,
- enabling full parallelization across different packages.
-
- Note that disabling this may overcommit CPU resources depending on the
- -j level of the main make process, the number of package submake jobs
- selected below and the number of actual CPUs present.
- Example: If the main make is passed a -j4 and the submake -j
- is also set to 4, we may end up with 16 parallel make processes
- in the worst case.
-
- config PKG_BUILD_JOBS
- int
- prompt "Number of package submake jobs (2-512)"
- range 2 512
- default 2
- depends on PKG_BUILD_PARALLEL && !PKG_BUILD_USE_JOBSERVER
- help
- The number of jobs (-jX) to pass to packages submake.
-
- config PKG_DEFAULT_PARALLEL
- bool
- prompt "Parallelize the default package build rule (May break build)"
- depends on PKG_BUILD_PARALLEL
- depends on BROKEN
- default n
- help
- Always set the default package build rules to parallel build.
-
- WARNING: This may break build or kill your cat, as it builds packages
- with multiple jobs that are probably not tested in a parallel build
- environment.
-
- Only say Y if you don't mind fixing broken packages. Before reporting
- build bugs, set this to N and re-run the build.
-
comment "Stripping options"
choice
config USE_UCLIBCXX
bool "uClibc++"
+ config USE_LIBCXX
+ bool "libc++"
+ depends on !USE_UCLIBC
+
config USE_LIBSTDCXX
bool "libstdc++"
endchoice
this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
Makefile.
+ choice
+ prompt "User space ASLR PIE compilation"
+ default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK)
+ default PKG_ASLR_PIE_REGULAR
+ help
+ Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
+ This enables package build as Position Independent Executables (PIE)
+ to protect against "return-to-text" attacks. This belongs to the
+ feature of Address Space Layout Randomisation (ASLR), which is
+ implemented by the kernel and the ELF loader by randomising the
+ location of memory allocations. This makes memory addresses harder
+ to predict when an attacker is attempting a memory-corruption exploit.
+ You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
+ Makefile.
+ Be ware that ASLR increases the binary size.
+ config PKG_ASLR_PIE_NONE
+ bool "None"
+ help
+ PIE is deactivated for all applications
+ config PKG_ASLR_PIE_REGULAR
+ bool "Regular"
+ help
+ PIE is activated for some binaries, mostly network exposed applications
+ config PKG_ASLR_PIE_ALL
+ bool "All"
+ select BUSYBOX_DEFAULT_PIE
+ help
+ PIE is activated for all applications
+ endchoice
+
choice
prompt "User space Stack-Smashing Protection"
depends on USE_MUSL
bool "None"
config PKG_CC_STACKPROTECTOR_REGULAR
bool "Regular"
- select SSP_SUPPORT if !USE_MUSL
+ select GCC_LIBSSP if !USE_MUSL
depends on KERNEL_CC_STACKPROTECTOR_REGULAR
config PKG_CC_STACKPROTECTOR_STRONG
bool "Strong"
- select SSP_SUPPORT if !USE_MUSL
- depends on GCC_VERSION_5
+ select GCC_LIBSSP if !USE_MUSL
depends on KERNEL_CC_STACKPROTECTOR_STRONG
endchoice
config KERNEL_CC_STACKPROTECTOR_REGULAR
bool "Regular"
config KERNEL_CC_STACKPROTECTOR_STRONG
- depends on GCC_VERSION_5
bool "Strong"
endchoice
+ config KERNEL_STACKPROTECTOR
+ bool
+ default KERNEL_CC_STACKPROTECTOR_REGULAR || KERNEL_CC_STACKPROTECTOR_STRONG
+
+ config KERNEL_STACKPROTECTOR_STRONG
+ bool
+ default KERNEL_CC_STACKPROTECTOR_STRONG
+
choice
prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)"
default PKG_FORTIFY_SOURCE_1
projects / openwrt / openwrt.git / blobdiff