config/Config-build.in

   1 # Copyright (C) 2006-2013 OpenWrt.org
   2 # Copyright (C) 2016 LEDE Project
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 menu "Global build settings"
   9
  10         config ALL_NONSHARED
  11                 bool "Select all target specific packages by default"
  12                 select ALL_KMODS
  13                 default BUILDBOT
  14
  15         config ALL_KMODS
  16                 bool "Select all kernel module packages by default"
  17
  18         config ALL
  19                 bool "Select all userspace packages by default"
  20                 select ALL_KMODS
  21                 select ALL_NONSHARED
  22
  23         config BUILDBOT
  24                 bool "Set build defaults for automatic builds (e.g. via buildbot)"
  25                 default n
  26                 help
  27                   This option changes several defaults to be more suitable for
  28                   automatic builds. This includes the following changes:
  29                   - Deleting build directories after compiling (to save space)
  30                   - Enabling per-device rootfs support
  31                   ...
  32
  33         config SIGNED_PACKAGES
  34                 bool "Cryptographically signed package lists"
  35                 default y
  36
  37         comment "General build options"
  38
  39         config TESTING_KERNEL
  40                 bool "Use the testing kernel version"
  41                 depends on HAS_TESTING_KERNEL
  42                 default n
  43                 help
  44                   If the target supports a newer kernel version than the default,
  45                   you can use this config option to enable it
  46
  47
  48         config DISPLAY_SUPPORT
  49                 bool "Show packages that require graphics support (local or remote)"
  50                 default n
  51
  52         config BUILD_PATENTED
  53                 default n
  54                 bool "Compile with support for patented functionality"
  55                 help
  56                   When this option is disabled, software which provides patented functionality
  57                   will not be built.  In case software provides optional support for patented
  58                   functionality, this optional support will get disabled for this package.
  59
  60         config BUILD_NLS
  61                 default n
  62                 bool "Compile with full language support"
  63                 help
  64                   When this option is enabled, packages are built with the full versions of
  65                   iconv and GNU gettext instead of the default OpenWrt stubs. If uClibc is
  66                   used, it is also built with locale support.
  67
  68         config SHADOW_PASSWORDS
  69                 bool
  70                 default y
  71
  72         config CLEAN_IPKG
  73                 bool
  74                 prompt "Remove ipkg/opkg status data files in final images"
  75                 default n
  76                 help
  77                   This removes all ipkg/opkg status data files from the target directory
  78                   before building the root filesystem.
  79
  80         config IPK_FILES_CHECKSUMS
  81                 bool
  82                 prompt "Record files checksums in package metadata"
  83                 default n
  84                 help
  85                   This makes file checksums part of package metadata. It increases size
  86                   but provides you with pkg_check command to check for flash coruptions.
  87
  88         config INCLUDE_CONFIG
  89                 bool "Include build configuration in firmware" if DEVEL
  90                 default n
  91                 help
  92                   If enabled, config.seed will be stored in /etc/build.config of firmware.
  93
  94         config COLLECT_KERNEL_DEBUG
  95                 bool
  96                 prompt "Collect kernel debug information"
  97                 select KERNEL_DEBUG_INFO
  98                 default BUILDBOT
  99                 help
 100                   This collects debugging symbols from the kernel and all compiled modules.
 101                   Useful for release builds, so that kernel issues can be debugged offline
 102                   later.
 103
 104         menu "Kernel build options"
 105
 106         source "config/Config-kernel.in"
 107
 108         endmenu
 109
 110         comment "Package build options"
 111
 112         config DEBUG
 113                 bool
 114                 prompt "Compile packages with debugging info"
 115                 default n
 116                 help
 117                   Adds -g3 to the CFLAGS.
 118
 119         config IPV6
 120                 bool
 121                 prompt "Enable IPv6 support in packages"
 122                 default y
 123                 help
 124                   Enables IPv6 support in kernel (builtin) and packages.
 125
 126         comment "Stripping options"
 127
 128         choice
 129                 prompt "Binary stripping method"
 130                 default USE_STRIP   if EXTERNAL_TOOLCHAIN
 131                 default USE_STRIP   if USE_GLIBC
 132                 default USE_SSTRIP
 133                 help
 134                   Select the binary stripping method you wish to use.
 135
 136                 config NO_STRIP
 137                         bool "none"
 138                         help
 139                           This will install unstripped binaries (useful for native
 140                           compiling/debugging).
 141
 142                 config USE_STRIP
 143                         bool "strip"
 144                         help
 145                           This will install binaries stripped using strip from binutils.
 146
 147
 148                 config USE_SSTRIP
 149                         bool "sstrip"
 150                         depends on !USE_GLIBC
 151                         help
 152                           This will install binaries stripped using sstrip.
 153         endchoice
 154
 155         config STRIP_ARGS
 156                 string
 157                 prompt "Strip arguments"
 158                 depends on USE_STRIP
 159                 default "--strip-unneeded --remove-section=.comment --remove-section=.note" if DEBUG
 160                 default "--strip-all"
 161                 help
 162                   Specifies arguments passed to the strip command when stripping binaries.
 163
 164         config STRIP_KERNEL_EXPORTS
 165                 bool "Strip unnecessary exports from the kernel image"
 166                 help
 167                   Reduces kernel size by stripping unused kernel exports from the kernel
 168                   image.  Note that this might make the kernel incompatible with any kernel
 169                   modules that were not selected at the time the kernel image was created.
 170
 171         config USE_MKLIBS
 172                 bool "Strip unnecessary functions from libraries"
 173                 help
 174                   Reduces libraries to only those functions that are necessary for using all
 175                   selected packages (including those selected as <M>).  Note that this will
 176                   make the system libraries incompatible with most of the packages that are
 177                   not selected during the build process.
 178
 179         choice
 180                 prompt "Preferred standard C++ library"
 181                 default USE_LIBSTDCXX if USE_GLIBC
 182                 default USE_UCLIBCXX
 183                 help
 184                   Select the preferred standard C++ library for all packages that support this.
 185
 186                 config USE_UCLIBCXX
 187                         bool "uClibc++"
 188
 189                 config USE_LIBSTDCXX
 190                         bool "libstdc++"
 191         endchoice
 192
 193         comment "Hardening build options"
 194
 195         config PKG_CHECK_FORMAT_SECURITY
 196                 bool
 197                 prompt "Enable gcc format-security"
 198                 default y
 199                 help
 200                   Add -Wformat -Werror=format-security to the CFLAGS.  You can disable
 201                   this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
 202                   Makefile.
 203
 204         config PKG_ASLR_PIE
 205                 bool
 206                 prompt "User space ASLR PIE compilation"
 207                 select BUSYBOX_DEFAULT_PIE
 208                 default n
 209                 help
 210                   Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
 211                   This enables package build as Position Independent Executables (PIE)
 212                   to protect against "return-to-text" attacks. This belongs to the
 213                   feature of Address Space Layout Randomisation (ASLR), which is
 214                   implemented by the kernel and the ELF loader by randomising the
 215                   location of memory allocations. This makes memory addresses harder
 216                   to predict when an attacker is attempting a memory-corruption exploit.
 217                   You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
 218                   Makefile.
 219
 220         choice
 221                 prompt "User space Stack-Smashing Protection"
 222                 depends on USE_MUSL
 223                 default PKG_CC_STACKPROTECTOR_REGULAR
 224                 help
 225                   Enable GCC Stack Smashing Protection (SSP) for userspace applications
 226                 config PKG_CC_STACKPROTECTOR_NONE
 227                         bool "None"
 228                 config PKG_CC_STACKPROTECTOR_REGULAR
 229                         bool "Regular"
 230                         select GCC_LIBSSP if !USE_MUSL
 231                         depends on KERNEL_CC_STACKPROTECTOR_REGULAR
 232                 config PKG_CC_STACKPROTECTOR_STRONG
 233                         bool "Strong"
 234                         select GCC_LIBSSP if !USE_MUSL
 235                         depends on !GCC_VERSION_4_8
 236                         depends on KERNEL_CC_STACKPROTECTOR_STRONG
 237         endchoice
 238
 239         choice
 240                 prompt "Kernel space Stack-Smashing Protection"
 241                 default KERNEL_CC_STACKPROTECTOR_REGULAR
 242                 depends on USE_MUSL || !(x86_64 || i386)
 243                 help
 244                   Enable GCC Stack-Smashing Protection (SSP) for the kernel
 245                 config KERNEL_CC_STACKPROTECTOR_NONE
 246                         bool "None"
 247                 config KERNEL_CC_STACKPROTECTOR_REGULAR
 248                         bool "Regular"
 249                 config KERNEL_CC_STACKPROTECTOR_STRONG
 250                         depends on !GCC_VERSION_4_8
 251                         bool "Strong"
 252         endchoice
 253
 254         config  KERNEL_STACKPROTECTOR
 255                 bool
 256                 default KERNEL_CC_STACKPROTECTOR_REGULAR || KERNEL_CC_STACKPROTECTOR_STRONG
 257
 258         config  KERNEL_STACKPROTECTOR_STRONG
 259                 bool
 260                 default KERNEL_CC_STACKPROTECTOR_STRONG
 261
 262         choice
 263                 prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)"
 264                 default PKG_FORTIFY_SOURCE_1
 265                 help
 266                   Enable the _FORTIFY_SOURCE macro which introduces additional
 267                   checks to detect buffer-overflows in the following standard library
 268                   functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy,
 269                   strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf,
 270                   gets.  "Conservative" (_FORTIFY_SOURCE set to 1) only introduces
 271                   checks that shouldn't change the behavior of conforming programs,
 272                   while "aggressive" (_FORTIFY_SOURCES set to 2) some more checking is
 273                   added, but some conforming programs might fail.
 274                 config PKG_FORTIFY_SOURCE_NONE
 275                         bool "None"
 276                 config PKG_FORTIFY_SOURCE_1
 277                         bool "Conservative"
 278                 config PKG_FORTIFY_SOURCE_2
 279                         bool "Aggressive"
 280         endchoice
 281
 282         choice
 283                 prompt "Enable RELRO protection"
 284                 default PKG_RELRO_FULL
 285                 help
 286                   Enable a link-time protection known as RELRO (Relocation Read Only)
 287                   which helps to protect from certain type of exploitation techniques
 288                   altering the content of some ELF sections. "Partial" RELRO makes the
 289                   .dynamic section not writeable after initialization, introducing
 290                   almost no performance penalty, while "full" RELRO also marks the GOT
 291                   as read-only at the cost of initializing all of it at startup.
 292                 config PKG_RELRO_NONE
 293                         bool "None"
 294                 config PKG_RELRO_PARTIAL
 295                         bool "Partial"
 296                 config PKG_RELRO_FULL
 297                         bool "Full"
 298         endchoice
 299
 300 endmenu