hardening: enable regular SSP support by default

[openwrt/staging/wigyori.git] / config / Config-build.in

diff --git a/config/Config-build.in b/config/Config-build.in
index 213609b8b2bf277659cd2e4eb1bf6d5046d6ead6..42b8e8e5e3acb27e17a832ef6359b43ccc38b955 100644 (file)
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -6,10 +6,18 @@
 
 menu "Global build settings"
 
+       config ALL_KMODS
+               bool "Select all kernel module packages by default"
+               default ALL
+
        config ALL
-               bool "Select all packages by default"
+               bool "Select all userspace packages by default"
                default n
 
+       config SIGNED_PACKAGES
+               bool "Cryptographically signed package lists"
+               default y
+
        comment "General build options"
 
        config DISPLAY_SUPPORT
@@ -203,7 +211,7 @@ menu "Global build settings"
        config PKG_CHECK_FORMAT_SECURITY
                bool
                prompt "Enable gcc format-security"
-               default n
+               default y
                help
                  Add -Wformat -Werror=format-security to the CFLAGS.  You can disable
                  this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
@@ -211,7 +219,7 @@ menu "Global build settings"
 
        choice
                prompt "User space Stack-Smashing Protection"
-               default PKG_CC_STACKPROTECTOR_NONE
+               default PKG_CC_STACKPROTECTOR_REGULAR
                help
                  Enable GCC Stack Smashing Protection (SSP) for userspace applications
                config PKG_CC_STACKPROTECTOR_NONE
@@ -229,7 +237,7 @@ menu "Global build settings"
 
        choice
                prompt "Kernel space Stack-Smashing Protection"
-               default KERNEL_CC_STACKPROTECTOR_NONE
+               default KERNEL_CC_STACKPROTECTOR_REGULAR
                help
                  Enable GCC Stack-Smashing Protection (SSP) for the kernel
                config KERNEL_CC_STACKPROTECTOR_NONE
@@ -262,6 +270,7 @@ menu "Global build settings"
 
        choice
                prompt "Enable RELRO protection"
+               default PKG_RELRO_FULL
                help
                  Enable a link-time protection known as RELRO (Relocation Read Only)
                  which helps to protect from certain type of exploitation techniques