profiles: force pie, ssp and -pch on hardened/linux/{uclibc,musl}

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>

diff --git a/profiles/hardened/linux/musl/use.force b/profiles/hardened/linux/musl/use.force
index 79e5575d13c38d63483a08e744b802690b28bfd8..e2d7cf05ec5c383c9fdd023b59ac05bdd22b9bce 100644 (file)
--- a/profiles/hardened/linux/musl/use.force
+++ b/profiles/hardened/linux/musl/use.force
@@ -2,3 +2,7 @@
 # Distributed under the terms of the GNU General Public License v2
 
 elibc_musl
+
+# Make sure people don't accidentally turn of ssp/pie in important packages.
+pie
+ssp

diff --git a/profiles/hardened/linux/musl/use.mask b/profiles/hardened/linux/musl/use.mask
index 190b01bbbe98c3c8e9c20894d81c3634e5dfed1a..b851b043ca085f7ff96615474ddde3427d43f105 100644 (file)
--- a/profiles/hardened/linux/musl/use.mask
+++ b/profiles/hardened/linux/musl/use.mask
@@ -6,3 +6,12 @@ elibc_uclibc
 elibc_glibc
 
 -hardened
+
+# precompiled headers are not compat with ASLR.
+pch
+
+# prelink is masked for hardened
+prelink
+
+# profile are incompatible when linking with pie
+profile

diff --git a/profiles/hardened/linux/uclibc/use.force b/profiles/hardened/linux/uclibc/use.force
new file mode 100644 (file)
index 0000000..b0ea123
--- /dev/null
+++ b/profiles/hardened/linux/uclibc/use.force
@@ -0,0 +1,8 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+elibc_uclibc
+
+# Make sure people don't accidentally turn of ssp/pie in important packages.
+pie
+ssp

diff --git a/profiles/hardened/linux/uclibc/use.mask b/profiles/hardened/linux/uclibc/use.mask
index 3d0c2a2a416d0e373ce68e6767f37dc6cef9a324..174226cb64e3099a7541dd49933b1a2516d90112 100644 (file)
--- a/profiles/hardened/linux/uclibc/use.mask
+++ b/profiles/hardened/linux/uclibc/use.mask
@@ -1,4 +1,17 @@
-# Copyright 1999-2014 Gentoo Foundation.
+# Copyright 1999-2017 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
+-elibc_uclibc
+elibc_musl
+elibc_glibc
+
 -hardened
+
+# precompiled headers are not compat with ASLR.
+pch
+
+# prelink is masked for hardened
+prelink
+
+# profile are incompatible when linking with pie
+profile