tree f3feb818bdfb57ddfe1bc6a595e31b3d540b4f49
parent f4a1ba5e78e225e598066c0a61474b943be5385a
author Ed Tanous <edtanous@google.com> 1611609336 -0800
committer Brad Bishop <bradleyb@fuzziesquirrel.com> 1611784507 +0000

Add security flags to all phosphor builds

Yocto has a built-in class for applying compiler security flags to
builds.  Some security concious projects within OpenBMC set these flags
manually.  We should do this project wide, given that it has a
negligible performance impact, and brings us in line with modern
security requirements.

There are some whitepapers on the specifics of what these flags do,
which is a much better documentation than I am able to write here, but
the key takeaways are that this:
1. Enables position independent code.
2. Enables FORTIFY_SOURCE level 2.
3. Enables -wformat and -wformat-security
4. Enables strong stack protection.

None of these flags should have any change in functional behavior.

Section 4.3 of this doc goes through this file in more detail:
https://www.nccgroup.com/globalassets/our-research/us/whitepapers/2018/improving-embedded-linux-security-yocto3.pdf

croserver/eCMD doesn't currently compile with these flags, so it's
explicitly excluded for the moment.  Patchset has been merged against
eCMD master to fix this, but we're so far behind, the bump doesn't build

obmc-libobmc-intf has an error that I can't quite understand yet about
unused results, which shouldn't have been effected by this, yet it seems
to be related to enabling the security hardening, so it is also excluded
from the security flags for the moment.

libpldm includes an IBM OEM command that relies on undefined behavior with
open() the proposed fix is here, but libpldm is excluded until that is
merged and bumped.
https://gerrit.openbmc-project.xyz/c/openbmc/pldm/+/3998412

Even with those three exceptions, getting a majority of the security flags
enabled on a majority of the repos should be an overall win.

Signed-off-by: Ed Tanous <edtanous@google.com>
Change-Id: I0483b1dbe1123a7beff8c5788363685487fb9c09