[PATCH 0/2] arm/arm64: localise objcopy flags

On Tue, Jul 12, 2016 at 11:28 AM, Mark Rutland [off-list ref] wrote:

Hi,

Typically, architectures (including arm and arm64) define OBJCOPYFLAGS in their
top-level makefile, for the purpose of generating a raw binaries suitable for
booting, including Image, zImage, vmlinux.bin, etc.

As this top-level arch makefile is included by the top-level kernel makefile,
these flags are passed to other invocations of objcopy tree-wide. This can
result in unexpected and inconsistent behaviour across architectures (e.g.
generation of a raw binary rather than an ELF [1]).

Rather than force each new user of objcopy to specially clear OBJCOPYFLAGS,
this patch moves the existing OBJCOPYFLAGS variable definitions such that they
only affects the cases we require them for today, leaving the global namespace
clear.

Other architectures will likely need similar treatment.

Oh excellent, thanks for doing this! I made an attempt at this back
when I ran into it with lkdtm, but I wasn't sure it was working as
intended. :)

Acked-by: Kees Cook <redacted>

-Kees

Thanks,
Mark.

[1] http://www.openwall.com/lists/kernel-hardening/2016/06/08/2

Mark Rutland (2):
  arm64: localise Image objcopy flags
  arm: localise objcopy flags

 arch/arm/Makefile        | 1 -
 arch/arm/boot/Makefile   | 2 ++
 arch/arm64/Makefile      | 1 -
 arch/arm64/boot/Makefile | 2 ++
 4 files changed, 4 insertions(+), 2 deletions(-)

--
1.9.1

-- 
Kees Cook
Chrome OS & Brillo Security