v1.5 branch refresh based upon upstream master @ c8677ca89e53e3be7988d54280fce166cc894a7e

[librecmc/librecmc.git] / config / Config-build.in

diff --git a/config/Config-build.in b/config/Config-build.in
index e0889fcccfc29b1364861933ceaa9e8595a697a6..7e12792d791948f824393eef8900cad244644306 100644 (file)
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -9,15 +9,16 @@ menu "Global build settings"
 
        config ALL_NONSHARED
                bool "Select all target specific packages by default"
-               default ALL || BUILDBOT
+               select ALL_KMODS
+               default BUILDBOT
 
        config ALL_KMODS
                bool "Select all kernel module packages by default"
-               default ALL
 
        config ALL
                bool "Select all userspace packages by default"
-               default n
+               select ALL_KMODS
+               select ALL_NONSHARED
 
        config BUILDBOT
                bool "Set build defaults for automatic builds (e.g. via buildbot)"
@@ -40,7 +41,7 @@ menu "Global build settings"
                default n
 
        config BUILD_PATENTED
-               default y
+               default n
                bool "Compile with support for patented functionality"
                help
                  When this option is disabled, software which provides patented functionality
@@ -52,7 +53,7 @@ menu "Global build settings"
                bool "Compile with full language support"
                help
                  When this option is enabled, packages are built with the full versions of
-                 iconv and GNU gettext instead of the default OpenWrt stubs. If uClibc is
+                 iconv and GNU gettext instead of the default libreCMC stubs. If uClibc is
                  used, it is also built with locale support.
 
        config SHADOW_PASSWORDS
@@ -67,6 +68,12 @@ menu "Global build settings"
                  This removes all ipkg/opkg status data files from the target directory
                  before building the root filesystem.
 
+       config INCLUDE_CONFIG
+               bool "Include build configuration in firmware" if DEVEL
+               default n
+               help
+                 If enabled, config.seed will be stored in /etc/build.config of firmware.
+
        config COLLECT_KERNEL_DEBUG
                bool
                prompt "Collect kernel debug information"
@@ -77,10 +84,12 @@ menu "Global build settings"
                  Useful for release builds, so that kernel issues can be debugged offline
                  later.
 
-       comment "Kernel build options"
+       menu "Kernel build options"
 
        source "config/Config-kernel.in"
 
+       endmenu
+
        comment "Package build options"
 
        config DEBUG
@@ -175,6 +184,22 @@ menu "Global build settings"
                  this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
                  Makefile.
 
+       config PKG_ASLR_PIE
+               bool
+               prompt "User space ASLR PIE compilation"
+               select BUSYBOX_DEFAULT_PIE
+               default n
+               help
+                 Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
+                 This enables package build as Position Independent Executables (PIE)
+                 to protect against "return-to-text" attacks. This belongs to the
+                 feature of Address Space Layout Randomisation (ASLR), which is
+                 implemented by the kernel and the ELF loader by randomising the
+                 location of memory allocations. This makes memory addresses harder
+                 to predict when an attacker is attempting a memory-corruption exploit.
+                 You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
+                 Makefile.
+
        choice
                prompt "User space Stack-Smashing Protection"
                depends on USE_MUSL
@@ -185,11 +210,11 @@ menu "Global build settings"
                        bool "None"
                config PKG_CC_STACKPROTECTOR_REGULAR
                        bool "Regular"
-                       select SSP_SUPPORT if !USE_MUSL
+                       select GCC_LIBSSP if !USE_MUSL
                        depends on KERNEL_CC_STACKPROTECTOR_REGULAR
                config PKG_CC_STACKPROTECTOR_STRONG
                        bool "Strong"
-                       select SSP_SUPPORT if !USE_MUSL
+                       select GCC_LIBSSP if !USE_MUSL
                        depends on !GCC_VERSION_4_8
                        depends on KERNEL_CC_STACKPROTECTOR_STRONG
        endchoice