File _service:obs_scm:0003-uadk_engine-add-secure-co... of Package uadk_engine

File _service:obs_scm:0003-uadk_engine-add-secure-compilation-option.patch of Package uadk_engine

From 638ee431907af6e9f4916e95a4f367e14499e819 Mon Sep 17 00:00:00 2001
From: Qi Tao <taoqi10@huawei.com>
Date: Thu, 18 Jan 2024 21:12:11 +0800
Subject: [PATCH 3/3] uadk_engine: add secure compilation option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add PIE, PIC, BIND_NOW, SP, NO Rpath/RunPath, FS,
Ftrapv and Strip compilation options.

PIC（-fPIC):
	Generate position-Independent-Code and andomly load
	dynamic libraries.
PIE(-fPIE -pie):
	Generate location-independent executables,which
	reduces the probability of fixed address attacks
	and buffer overflow attacks.
BIND_NOW(-Wl,-z,relro,-z,now):
	GOT table redirects all read-only,which defends
	against ret2plt attacks.
SP(-fstack-protector-strong/all):
	Determine whether an overflow attack occurs.
Strip(-Wl,-s):
	Deleting symbol tables defends against hacker
	attacks and reduces the file size.
FS(-D_FORTIFY_SOURCE=2 -O2):
	Provides access checks for fixed-size buffers
	at compile time and at run time.
Ftrapv(-ftrapv):
	Detects integer overflow.
NO Rpath/RunPath(hardcode_into_libs=no):
	Eliminates dynamic library search paths,
	which defense against attacks by replacing
	dynamic libraries with the same name.

Signed-off-by: Qi Tao <taoqi10@huawei.com>
---
 configure.ac    | 1 +
 src/Makefile.am | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/configure.ac b/configure.ac
index 6c5369e..99b85e9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -7,6 +7,7 @@ AC_CONFIG_HEADERS([config.h])
 
 AC_PROG_CC
 LT_INIT
+AC_SUBST([hardcode_into_libs], [no])
 
 AC_ARG_ENABLE(kae,
 	      AS_HELP_STRING([--enable-kae],[Enable kae support]))
diff --git a/src/Makefile.am b/src/Makefile.am
index c4b8aa9..e014052 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,6 +18,8 @@ uadk_engine_la_LIBADD=-ldl $(WD_LIBS) -lpthread
 uadk_engine_la_LDFLAGS=-module -version-number $(VERSION)
 uadk_engine_la_CFLAGS=$(WD_CFLAGS) $(libcrypto_CFLAGS)
 uadk_engine_la_CFLAGS+=-DCRYPTO
+uadk_engine_la_CFLAGS+=-fPIC -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 \
+		       -O2 -ftrapv -Wl,-z,relro,-z,now -Wl,-s
 
 AUTOMAKE_OPTIONS = subdir-objects
 
-- 
2.25.1