From: Hauke Mehrtens Date: Sun, 5 Oct 2025 21:30:17 +0000 (+0200) Subject: build: Add _FORTIFY_SOURCE=3 support X-Git-Tag: v25.12.0-rc1~760 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F20313%2Fhead;p=thirdparty%2Fopenwrt.git build: Add _FORTIFY_SOURCE=3 support Add support for _FORTIFY_SOURCE level 3. This is supported with glibc and with musl libc. Link: https://github.com/openwrt/openwrt/pull/20313 Signed-off-by: Hauke Mehrtens --- diff --git a/config/Config-build.in b/config/Config-build.in index 42b353ecf72..2d08f4ccd2b 100644 --- a/config/Config-build.in +++ b/config/Config-build.in @@ -358,9 +358,11 @@ menu "Global build settings" config PKG_FORTIFY_SOURCE_NONE bool "None" config PKG_FORTIFY_SOURCE_1 - bool "Conservative" + bool "Conservative Level 1" config PKG_FORTIFY_SOURCE_2 - bool "Aggressive" + bool "Aggressive Level 2" + config PKG_FORTIFY_SOURCE_3 + bool "Aggressive Level 3" endchoice choice diff --git a/include/hardening.mk b/include/hardening.mk index 4a8874261b9..a2be5eabd0d 100644 --- a/include/hardening.mk +++ b/include/hardening.mk @@ -51,6 +51,11 @@ ifdef CONFIG_PKG_FORTIFY_SOURCE_2 TARGET_CFLAGS += -D_FORTIFY_SOURCE=2 endif endif +ifdef CONFIG_PKG_FORTIFY_SOURCE_3 + ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1) + TARGET_CFLAGS += -D_FORTIFY_SOURCE=3 + endif +endif ifdef CONFIG_PKG_RELRO_PARTIAL ifeq ($(strip $(PKG_RELRO)),1) TARGET_CFLAGS += -Wl,-z,relro diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk index 02906d34b21..25d5d66aca0 100644 --- a/toolchain/glibc/common.mk +++ b/toolchain/glibc/common.mk @@ -68,6 +68,7 @@ GLIBC_CONFIGURE:= \ $(if $(CONFIG_PKG_RELRO_FULL),--enable-bind-now) \ $(if $(CONFIG_PKG_FORTIFY_SOURCE_1),--enable-fortify-source=1) \ $(if $(CONFIG_PKG_FORTIFY_SOURCE_2),--enable-fortify-source=2) \ + $(if $(CONFIG_PKG_FORTIFY_SOURCE_3),--enable-fortify-source=3) \ --enable-kernel=6.6.0 export libc_cv_ssp=no