Enable GCC stack protection (aka Propolice) for userland:

- It is opt-out for now so as to give it maximum testing, but it may be
  turned opt-in for stable branches depending on the consensus.  You
  can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
  It is harmless to steal the knob as SSP symbols have been provided
  by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
  (sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
  libc will be automatically downgraded to -fstack-protector because it
  breaks rtld otherwise.
- This option is unavailable on ia64.

Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.

Submitted by:	Jeremie Le Hen <jeremie@le-hen.org>

2 files changed, 3 insertions, 0 deletions

diff --git a/rescue/librescue/Makefile b/rescue/librescue/Makefile
index 03ffec5..9fd3c8f 100644
--- a/rescue/librescue/Makefile
+++ b/rescue/librescue/Makefile
@@ -2,6 +2,8 @@
 # $FreeBSD$
 #
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 # Certain library entries have hard-coded references to
diff --git a/rescue/rescue/Makefile b/rescue/rescue/Makefile
index 2b09127..a21d0f2 100644
--- a/rescue/rescue/Makefile
+++ b/rescue/rescue/Makefile
@@ -2,6 +2,7 @@
 #	@(#)Makefile	8.1 (Berkeley) 6/2/93
 
 NO_MAN=
+WITHOUT_SSP=
 
 .include <bsd.own.mk>