Enable GCC stack protection (aka Propolice) for userland:

- It is opt-out for now so as to give it maximum testing, but it may be
  turned opt-in for stable branches depending on the consensus.  You
  can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
  It is harmless to steal the knob as SSP symbols have been provided
  by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
  (sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
  libc will be automatically downgraded to -fstack-protector because it
  breaks rtld otherwise.
- This option is unavailable on ia64.

Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.

Submitted by:	Jeremie Le Hen <jeremie@le-hen.org>

18 files changed, 39 insertions, 0 deletions

diff --git a/sys/boot/Makefile.inc b/sys/boot/Makefile.inc
new file mode 100644
index 0000000..09bde81
--- /dev/null
+++ b/sys/boot/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+WITHOUT_SSP=
diff --git a/sys/boot/arm/Makefile.inc b/sys/boot/arm/Makefile.inc
new file mode 100644
index 0000000..265f86d
--- /dev/null
+++ b/sys/boot/arm/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/boot/arm/at91/Makefile.inc b/sys/boot/arm/at91/Makefile.inc
index 403fad0..2f528e3 100644
--- a/sys/boot/arm/at91/Makefile.inc
+++ b/sys/boot/arm/at91/Makefile.inc
@@ -53,3 +53,5 @@ MK_FPGA:=no
 .endif
 
 .endif
+
+.include "../Makefile.inc"
diff --git a/sys/boot/efi/Makefile.inc b/sys/boot/efi/Makefile.inc
index 2668708..fdfd59c 100644
--- a/sys/boot/efi/Makefile.inc
+++ b/sys/boot/efi/Makefile.inc
@@ -5,3 +5,5 @@ BINDIR?=	/boot
 # Options used when building app-specific efi components
 CFLAGS+=	-ffreestanding -fshort-wchar -Wformat
 LDFLAGS+=	-nostdlib
+
+.include "../Makefile.inc"
diff --git a/sys/boot/i386/Makefile.inc b/sys/boot/i386/Makefile.inc
index 9b53cc9..72c6395 100644
--- a/sys/boot/i386/Makefile.inc
+++ b/sys/boot/i386/Makefile.inc
@@ -24,3 +24,5 @@ BTXDIR=		${.CURDIR}/../btx
 BTXLDR=		${BTXDIR}/btxldr/btxldr
 BTXKERN=	${BTXDIR}/btx/btx
 BTXCRT=		${BTXDIR}/lib/crt0.o
+
+.include "../Makefile.inc"
diff --git a/sys/boot/i386/loader/Makefile b/sys/boot/i386/loader/Makefile
index fb8cc83..df2ccc0 100644
--- a/sys/boot/i386/loader/Makefile
+++ b/sys/boot/i386/loader/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader.sym
diff --git a/sys/boot/ia64/Makefile.inc b/sys/boot/ia64/Makefile.inc
index 2e9a113..e63fb54 100644
--- a/sys/boot/ia64/Makefile.inc
+++ b/sys/boot/ia64/Makefile.inc
@@ -5,3 +5,5 @@ BINDIR?=	/boot
 # Options used when building standalone components
 CFLAGS+=	-ffreestanding -fshort-wchar -Wformat
 LDFLAGS+=	-nostdlib
+
+.include "../Makefile.inc"
diff --git a/sys/boot/ia64/common/Makefile b/sys/boot/ia64/common/Makefile
index b410bd8..d36c550 100644
--- a/sys/boot/ia64/common/Makefile
+++ b/sys/boot/ia64/common/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 LIB=		ia64
diff --git a/sys/boot/ia64/efi/Makefile b/sys/boot/ia64/efi/Makefile
index 0c07610..5c7fda5 100644
--- a/sys/boot/ia64/efi/Makefile
+++ b/sys/boot/ia64/efi/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 NO_MAN=
+WITHOUT_SSP=
 
 .include <bsd.own.mk>
 
diff --git a/sys/boot/ia64/ski/Makefile b/sys/boot/ia64/ski/Makefile
index 42d24d1..76498d3 100644
--- a/sys/boot/ia64/ski/Makefile
+++ b/sys/boot/ia64/ski/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 NO_MAN=
+WITHOUT_SSP=
 
 .include <bsd.own.mk>
 
diff --git a/sys/boot/ofw/Makefile.inc b/sys/boot/ofw/Makefile.inc
new file mode 100644
index 0000000..265f86d
--- /dev/null
+++ b/sys/boot/ofw/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/boot/pc98/Makefile.inc b/sys/boot/pc98/Makefile.inc
index 5bdddee..418394a 100644
--- a/sys/boot/pc98/Makefile.inc
+++ b/sys/boot/pc98/Makefile.inc
@@ -19,3 +19,5 @@ BTXDIR=		${.CURDIR}/../btx
 BTXLDR=		${BTXDIR}/btxldr/btxldr
 BTXKERN=	${BTXDIR}/btx/btx
 BTXCRT=		${BTXDIR}/lib/crt0.o
+
+.include "../Makefile.inc"
diff --git a/sys/boot/pc98/loader/Makefile b/sys/boot/pc98/loader/Makefile
index 0ad93c1..a8b35ff 100644
--- a/sys/boot/pc98/loader/Makefile
+++ b/sys/boot/pc98/loader/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader.sym
diff --git a/sys/boot/powerpc/Makefile.inc b/sys/boot/powerpc/Makefile.inc
new file mode 100644
index 0000000..265f86d
--- /dev/null
+++ b/sys/boot/powerpc/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/boot/powerpc/ofw/Makefile b/sys/boot/powerpc/ofw/Makefile
index 9b2cf8d..2bdde76 100644
--- a/sys/boot/powerpc/ofw/Makefile
+++ b/sys/boot/powerpc/ofw/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader
diff --git a/sys/boot/sparc64/Makefile.inc b/sys/boot/sparc64/Makefile.inc
index f2170c8..ef5a7ce 100644
--- a/sys/boot/sparc64/Makefile.inc
+++ b/sys/boot/sparc64/Makefile.inc
@@ -3,3 +3,5 @@
 BINDIR?=	/boot
 CFLAGS+=	-ffreestanding
 LDFLAGS+=	-nostdlib
+
+.include "../Makefile.inc"
diff --git a/sys/boot/sparc64/loader/Makefile b/sys/boot/sparc64/loader/Makefile
index 784ab92..9ee93d4 100644
--- a/sys/boot/sparc64/loader/Makefile
+++ b/sys/boot/sparc64/loader/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader
diff --git a/sys/boot/uboot/Makefile.inc b/sys/boot/uboot/Makefile.inc
new file mode 100644
index 0000000..265f86d
--- /dev/null
+++ b/sys/boot/uboot/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"