global: introduce ALL_NONSHARED symbol

Introduce a new symbol ALL_NONSHARED which selects all non-sharable packages
by default. This option is mainly intented for buildbot setups to build the
target dependant software subset only.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

build: do not deselect CONFIG_USE_SSTRIP if CONFIG_DEBUG is enabled

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@48504 3c298f89-4303-0410-b956-a3cf2f4a3e73

build: use sstrip by default for musl

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@48313 3c298f89-4303-0410-b956-a3cf2f4a3e73

linux: make IPv6 builtin if selected (saves >30KB)

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46834 3c298f89-4303-0410-b956-a3cf2f4a3e73

gcc: remove version 4.9-linaro

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46798 3c298f89-4303-0410-b956-a3cf2f4a3e73

enable strong SSP / Stackprotector on gcc5

Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46685 3c298f89-4303-0410-b956-a3cf2f4a3e73

build: disable kernel stack protector support for i386/x86_64

When stack protector support is disabled in libc (always the case for
!musl), gcc assumes that it needs to use __stack_chk_guard for the stack
canary.
This causes kernel build errors, because the kernel is only set up to
handle TLS stack canaries.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46543 3c298f89-4303-0410-b956-a3cf2f4a3e73

hardening: disable user-space SSP for !musl

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46146 3c298f89-4303-0410-b956-a3cf2f4a3e73

toolchain: add fortify-headers, enable FORTIFY_SOURCE by default

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46117 3c298f89-4303-0410-b956-a3cf2f4a3e73

gcc/musl: rework SSP-support

Make musl provide libssp_nonshared.a and make GCC link it unconditionally
if musl is used. This should be a no-op if SSP is disabled and seems to be
the only reliable way of dealing with SSP over all packages due to the mess
that is linkerflags handling in packages.

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46108 3c298f89-4303-0410-b956-a3cf2f4a3e73

hardening: enable regular SSP support by default

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46020 3c298f89-4303-0410-b956-a3cf2f4a3e73

hardening: enable RELRO by default

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46004 3c298f89-4303-0410-b956-a3cf2f4a3e73

hardening: enable format security checking by default

Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46003 3c298f89-4303-0410-b956-a3cf2f4a3e73

build: enable package list signing by default

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@45614 3c298f89-4303-0410-b956-a3cf2f4a3e73

build: add integration for managing opkg package feed keys

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@45286 3c298f89-4303-0410-b956-a3cf2f4a3e73

buildroot: make it easier to build all kmods

Split out kmods from ALL to make it easier to create local builds that
are compatible kmod-wise with releases.

Signed-off-by: Jonas Gorski <jogo@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@44830 3c298f89-4303-0410-b956-a3cf2f4a3e73

toolchain: The glorious return of glibc, ver 2.21

It's the eglibc packaging with a bit of spit-polishing. And testing. :-)

[blogic: merged glibc and eglibc into 1 and made eglibc a glibc variant]

Signed-off-by: Jeff Waugh <jdub@bethesignal.org>
Signed-off-by: John Crispin <blogic@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@44701 3c298f89-4303-0410-b956-a3cf2f4a3e73

config: remove CONFIG_BUILD_STATIC_TOOLS

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@44287 3c298f89-4303-0410-b956-a3cf2f4a3e73

config: fix typo in Global build settings menu

Signed-off-by: Nicolas Thill <nico@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@44258 3c298f89-4303-0410-b956-a3cf2f4a3e73

config: fix typo in Global build settings menu

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@44163 3c298f89-4303-0410-b956-a3cf2f4a3e73

Support for building an hardened OpenWRT

Introduce configuration options to build an "hardened" OpenWRT.

Options to enable Stack-Smashing Protection, FORTIFY_SOURCE and RELRO
have been introduced.

uClibc makefile now automatically detects if SSP support is necessary.

hostapd makefile has been fixed to use "^" as sed separator since
using a comma was problematic when using "-Wl,-z,now" and the like in
TARGET_CFLAGS.

Currently enabling SSP on user space depends on enabling SSP kernel
side, this is due to the fact that TARGET_CFLAGS are used to build
kernel modules (at least). Suggestions on how to avoid this are welcome.
Using "select" instead of "depends on" doesn't seem to work with choice
entries.

Tested with a lantiq (WBMR) router, GCC 4.8, uClibc and a subset of
the available packages.
Needs to be tested with GCC 4.9 and the remaining packages.
PIE not currently included.

Signed-off-by: Alessandro Di Federico <ale+owrt@clearmind.me>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@44005 3c298f89-4303-0410-b956-a3cf2f4a3e73

Kconfig: Various typo/grammar/line-length fixes in Config*.in files

Non-functional changes to config/Config-*.in files, including:

* spelling mistakes
* inconsistent terminology
* grammar
* overly long lines in "help" components

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@42519 3c298f89-4303-0410-b956-a3cf2f4a3e73

PKG_CHECK_FORMAT_SECURITY: add a menuconfig option, disable by default

The idea is still to enable it by default at some point
I've tested all ar71xx packages (except oldpackages) using CONFIG_ALL=y
Failing packages have been marked with PKG_CHECK_FORMAT_SECURITY:=0 for now
I can test more targets but i have no idea which are the most used

Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@42282 3c298f89-4303-0410-b956-a3cf2f4a3e73

move menuconfig options into separate files

Signed-off-by: Imre Kaloz <kaloz@openwrt.org>



git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38895 3c298f89-4303-0410-b956-a3cf2f4a3e73