StrixOS/build
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Enable CFI by default but restrict CFI_INCLUDE_PATHS" into pi-dev

Browse Source
This commit is contained in:
TreeHugger Robot
2018-05-25 07:15:45 +00:00
committed by Android (Google) Code Review
parent bd03c1513f 6106a4ead5
commit d002e49501
3 changed files with 17 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/config_sanitizers.mk
View File

@@ -96,8 +96,9 @@ ifeq ($(LOCAL_SANITIZE),never)
my_sanitize_diag := my_sanitize_diag :=
endif endif
# Enable CFI in included paths. # Enable CFI in included paths (for Arm64 only).
ifeq ($(filter cfi, $(my_sanitize)),) ifeq ($(filter cfi, $(my_sanitize)),)
ifneq ($(filter arm64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
combined_include_paths := $(CFI_INCLUDE_PATHS) \ combined_include_paths := $(CFI_INCLUDE_PATHS) \
$(PRODUCT_CFI_INCLUDE_PATHS) $(PRODUCT_CFI_INCLUDE_PATHS)
@@ -106,6 +107,7 @@ ifeq ($(filter cfi, $(my_sanitize)),)
my_sanitize := cfi $(my_sanitize) my_sanitize := cfi $(my_sanitize)
my_sanitize_diag := cfi $(my_sanitize_diag) my_sanitize_diag := cfi $(my_sanitize_diag)
endif endif
endif
endif endif
# If CFI is disabled globally, remove it from my_sanitize. # If CFI is disabled globally, remove it from my_sanitize.

4
target/product/core_64_bit.mk
View File

@@ -31,3 +31,7 @@ PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.zygote=zygote64_32
TARGET_SUPPORTS_32_BIT_APPS := true TARGET_SUPPORTS_32_BIT_APPS := true
TARGET_SUPPORTS_64_BIT_APPS := true TARGET_SUPPORTS_64_BIT_APPS := true
# Enable CFI for security-sensitive components
$(call inherit-product, $(SRC_TARGET_DIR)/product/cfi-common.mk)
$(call inherit-product-if-exists, vendor/google/products/cfi-vendor.mk)

4
target/product/core_64_bit_only.mk
View File

@@ -28,3 +28,7 @@ PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.zygote=zygote64
TARGET_SUPPORTS_32_BIT_APPS := false TARGET_SUPPORTS_32_BIT_APPS := false
TARGET_SUPPORTS_64_BIT_APPS := true TARGET_SUPPORTS_64_BIT_APPS := true
# Enable CFI for security-sensitive components
$(call inherit-product, $(SRC_TARGET_DIR)/product/cfi-common.mk)
$(call inherit-product-if-exists, vendor/google/products/cfi-vendor.mk)