73adeee385
* Enable FORITFY and NX for native builds meshtasticd does have an executable stack and is not built with fortify, which makes exploitation of memory corruption bugs easier than it has to be. This enables fortify and a non-executable stack. This gives the following improvements on Debian Trixie: $ checksec --file=./.pio/build/native/meshtasticd RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH 13516 Symbols No 0 17 ./.pio/build/native/meshtasticd $ checksec --file=./.pio/build/native/meshtasticd RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH 13519 Symbols Yes 12 20 ./.pio/build/native/meshtasticd Tested with --sim mode I do not get any crashes or similar. * Enable FORTIFY and NX for native builds meshtasticd does have an executable stack and is not built with fortify, which makes exploitation of memory corruption bugs easier than it has to be. This enables fortify and a non-executable stack. This gives the following improvements on Debian Trixie: $ checksec --file=./.pio/build/native/meshtasticd RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH 13516 Symbols No 0 17 ./.pio/build/native/meshtasticd $ checksec --file=./.pio/build/native/meshtasticd RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH 13519 Symbols Yes 12 20 ./.pio/build/native/meshtasticd Tested with --sim mode I do not get any crashes or similar. * Enable FORTIFY and SP for native builds meshtasticd does have a stack canaries and is not built with fortify, which makes exploitation of memory corruption bugs easier than it has to be. This enables fortify and stack canaries. This gives the following improvements on Debian Trixie: $ checksec --file=./.pio/build/native/meshtasticd RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH 13516 Symbols No 0 17 ./.pio/build/native/meshtasticd $ checksec --file=./.pio/build/native/meshtasticd RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH 13519 Symbols Yes 12 20 ./.pio/build/native/meshtasticd Tested with --sim mode I do not get any crashes or similar. --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
64 lines
2.2 KiB
INI
64 lines
2.2 KiB
INI
; The Portduino based 'native' environment. Currently supported on Linux targets with real LoRa hardware (or simulated).
|
|
[portduino_base]
|
|
platform =
|
|
# renovate: datasource=git-refs depName=platform-native packageName=https://github.com/meshtastic/platform-native gitBranch=develop
|
|
https://github.com/meshtastic/platform-native/archive/f566d364204416cdbf298e349213f7d551f793d9.zip
|
|
framework = arduino
|
|
|
|
build_src_filter =
|
|
${env.build_src_filter}
|
|
-<platform/esp32/>
|
|
-<nimble/>
|
|
-<platform/nrf52/>
|
|
-<platform/stm32wl/>
|
|
-<platform/rp2xx0>
|
|
-<mesh/wifi/>
|
|
-<mesh/http/>
|
|
+<mesh/raspihttp/>
|
|
-<mesh/eth/>
|
|
-<modules/esp32>
|
|
|
|
lib_deps =
|
|
${env.lib_deps}
|
|
${networking_base.lib_deps}
|
|
${networking_extra.lib_deps}
|
|
${radiolib_base.lib_deps}
|
|
${environmental_base.lib_deps}
|
|
# renovate: datasource=custom.pio depName=rweather/Crypto packageName=rweather/library/Crypto
|
|
rweather/Crypto@0.4.0
|
|
# renovate: datasource=custom.pio depName=LovyanGFX packageName=lovyan03/library/LovyanGFX
|
|
lovyan03/LovyanGFX@1.2.19
|
|
# renovate: datasource=git-refs depName=libch341-spi-userspace packageName=https://github.com/pine64/libch341-spi-userspace gitBranch=main
|
|
https://github.com/pine64/libch341-spi-userspace/archive/23c42319a69cffcb65868e3c72e6bed83974a393.zip
|
|
# renovate: datasource=custom.pio depName=adafruit/Adafruit seesaw Library packageName=adafruit/library/Adafruit seesaw Library
|
|
adafruit/Adafruit seesaw Library@1.7.9
|
|
# renovate: datasource=git-refs depName=RAK12034-BMX160 packageName=https://github.com/RAKWireless/RAK12034-BMX160 gitBranch=main
|
|
https://github.com/RAKWireless/RAK12034-BMX160/archive/dcead07ffa267d3c906e9ca4a1330ab989e957e2.zip
|
|
# renovate: datasource=custom.pio depName=adafruit/Adafruit BME680 Library packageName=adafruit/library/Adafruit BME680
|
|
adafruit/Adafruit BME680 Library@^2.0.5
|
|
|
|
build_flags =
|
|
${arduino_base.build_flags}
|
|
-D ARCH_PORTDUINO
|
|
-fPIC
|
|
-D_FORTIFY_SOURCE=2
|
|
-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4
|
|
-Isrc/platform/portduino
|
|
-DRADIOLIB_EEPROM_UNSUPPORTED
|
|
-DPORTDUINO_LINUX_HARDWARE
|
|
-DHAS_UDP_MULTICAST=1
|
|
-lpthread
|
|
-lstdc++fs
|
|
-lbluetooth
|
|
-lgpiod
|
|
-lyaml-cpp
|
|
-li2c
|
|
-luv
|
|
-std=gnu17
|
|
-std=c++17
|
|
|
|
lib_ignore =
|
|
Adafruit NeoPixel
|
|
Adafruit ST7735 and ST7789 Library
|
|
SD
|