Config-build.in 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275
  1. # Copyright (C) 2006-2013 OpenWrt.org
  2. # Copyright (C) 2016 LEDE Project
  3. #
  4. # This is free software, licensed under the GNU General Public License v2.
  5. # See /LICENSE for more information.
  6. #
  7. menu "Global build settings"
  8. config ALL_NONSHARED
  9. bool "Select all target specific packages by default"
  10. select ALL_KMODS
  11. default BUILDBOT
  12. config ALL_KMODS
  13. bool "Select all kernel module packages by default"
  14. config ALL
  15. bool "Select all userspace packages by default"
  16. select ALL_KMODS
  17. select ALL_NONSHARED
  18. config BUILDBOT
  19. bool "Set build defaults for automatic builds (e.g. via buildbot)"
  20. default n
  21. help
  22. This option changes several defaults to be more suitable for
  23. automatic builds. This includes the following changes:
  24. - Deleting build directories after compiling (to save space)
  25. - Enabling per-device rootfs support
  26. ...
  27. config SIGNED_PACKAGES
  28. bool "Cryptographically signed package lists"
  29. default y
  30. comment "General build options"
  31. config DISPLAY_SUPPORT
  32. bool "Show packages that require graphics support (local or remote)"
  33. default n
  34. config BUILD_PATENTED
  35. default n
  36. bool "Compile with support for patented functionality"
  37. help
  38. When this option is disabled, software which provides patented functionality
  39. will not be built. In case software provides optional support for patented
  40. functionality, this optional support will get disabled for this package.
  41. config BUILD_NLS
  42. default n
  43. bool "Compile with full language support"
  44. help
  45. When this option is enabled, packages are built with the full versions of
  46. iconv and GNU gettext instead of the default libreCMC stubs. If uClibc is
  47. used, it is also built with locale support.
  48. config SHADOW_PASSWORDS
  49. bool
  50. default y
  51. config CLEAN_IPKG
  52. bool
  53. prompt "Remove ipkg/opkg status data files in final images"
  54. default n
  55. help
  56. This removes all ipkg/opkg status data files from the target directory
  57. before building the root filesystem.
  58. config INCLUDE_CONFIG
  59. bool "Include build configuration in firmware" if DEVEL
  60. default n
  61. help
  62. If enabled, config.seed will be stored in /etc/build.config of firmware.
  63. config COLLECT_KERNEL_DEBUG
  64. bool
  65. prompt "Collect kernel debug information"
  66. select KERNEL_DEBUG_INFO
  67. default BUILDBOT
  68. help
  69. This collects debugging symbols from the kernel and all compiled modules.
  70. Useful for release builds, so that kernel issues can be debugged offline
  71. later.
  72. menu "Kernel build options"
  73. source "config/Config-kernel.in"
  74. endmenu
  75. comment "Package build options"
  76. config DEBUG
  77. bool
  78. prompt "Compile packages with debugging info"
  79. default n
  80. help
  81. Adds -g3 to the CFLAGS.
  82. config IPV6
  83. bool
  84. prompt "Enable IPv6 support in packages"
  85. default y
  86. help
  87. Enables IPv6 support in kernel (builtin) and packages.
  88. comment "Stripping options"
  89. choice
  90. prompt "Binary stripping method"
  91. default USE_STRIP if EXTERNAL_TOOLCHAIN
  92. default USE_STRIP if USE_GLIBC
  93. default USE_SSTRIP
  94. help
  95. Select the binary stripping method you wish to use.
  96. config NO_STRIP
  97. bool "none"
  98. help
  99. This will install unstripped binaries (useful for native
  100. compiling/debugging).
  101. config USE_STRIP
  102. bool "strip"
  103. help
  104. This will install binaries stripped using strip from binutils.
  105. config USE_SSTRIP
  106. bool "sstrip"
  107. depends on !USE_GLIBC
  108. help
  109. This will install binaries stripped using sstrip.
  110. endchoice
  111. config STRIP_ARGS
  112. string
  113. prompt "Strip arguments"
  114. depends on USE_STRIP
  115. default "--strip-unneeded --remove-section=.comment --remove-section=.note" if DEBUG
  116. default "--strip-all"
  117. help
  118. Specifies arguments passed to the strip command when stripping binaries.
  119. config STRIP_KERNEL_EXPORTS
  120. bool "Strip unnecessary exports from the kernel image"
  121. help
  122. Reduces kernel size by stripping unused kernel exports from the kernel
  123. image. Note that this might make the kernel incompatible with any kernel
  124. modules that were not selected at the time the kernel image was created.
  125. config USE_MKLIBS
  126. bool "Strip unnecessary functions from libraries"
  127. help
  128. Reduces libraries to only those functions that are necessary for using all
  129. selected packages (including those selected as <M>). Note that this will
  130. make the system libraries incompatible with most of the packages that are
  131. not selected during the build process.
  132. choice
  133. prompt "Preferred standard C++ library"
  134. default USE_LIBSTDCXX if USE_GLIBC
  135. default USE_UCLIBCXX
  136. help
  137. Select the preferred standard C++ library for all packages that support this.
  138. config USE_UCLIBCXX
  139. bool "uClibc++"
  140. config USE_LIBSTDCXX
  141. bool "libstdc++"
  142. endchoice
  143. comment "Hardening build options"
  144. config PKG_CHECK_FORMAT_SECURITY
  145. bool
  146. prompt "Enable gcc format-security"
  147. default y
  148. help
  149. Add -Wformat -Werror=format-security to the CFLAGS. You can disable
  150. this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
  151. Makefile.
  152. config PKG_ASLR_PIE
  153. bool
  154. prompt "User space ASLR PIE compilation"
  155. select BUSYBOX_DEFAULT_PIE
  156. default n
  157. help
  158. Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
  159. This enables package build as Position Independent Executables (PIE)
  160. to protect against "return-to-text" attacks. This belongs to the
  161. feature of Address Space Layout Randomisation (ASLR), which is
  162. implemented by the kernel and the ELF loader by randomising the
  163. location of memory allocations. This makes memory addresses harder
  164. to predict when an attacker is attempting a memory-corruption exploit.
  165. You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
  166. Makefile.
  167. choice
  168. prompt "User space Stack-Smashing Protection"
  169. depends on USE_MUSL
  170. default PKG_CC_STACKPROTECTOR_REGULAR
  171. help
  172. Enable GCC Stack Smashing Protection (SSP) for userspace applications
  173. config PKG_CC_STACKPROTECTOR_NONE
  174. bool "None"
  175. config PKG_CC_STACKPROTECTOR_REGULAR
  176. bool "Regular"
  177. select GCC_LIBSSP if !USE_MUSL
  178. depends on KERNEL_CC_STACKPROTECTOR_REGULAR
  179. config PKG_CC_STACKPROTECTOR_STRONG
  180. bool "Strong"
  181. select GCC_LIBSSP if !USE_MUSL
  182. depends on !GCC_VERSION_4_8
  183. depends on KERNEL_CC_STACKPROTECTOR_STRONG
  184. endchoice
  185. choice
  186. prompt "Kernel space Stack-Smashing Protection"
  187. default KERNEL_CC_STACKPROTECTOR_REGULAR
  188. depends on USE_MUSL || !(x86_64 || i386)
  189. help
  190. Enable GCC Stack-Smashing Protection (SSP) for the kernel
  191. config KERNEL_CC_STACKPROTECTOR_NONE
  192. bool "None"
  193. config KERNEL_CC_STACKPROTECTOR_REGULAR
  194. bool "Regular"
  195. config KERNEL_CC_STACKPROTECTOR_STRONG
  196. depends on !GCC_VERSION_4_8
  197. bool "Strong"
  198. endchoice
  199. choice
  200. prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)"
  201. default PKG_FORTIFY_SOURCE_1
  202. help
  203. Enable the _FORTIFY_SOURCE macro which introduces additional
  204. checks to detect buffer-overflows in the following standard library
  205. functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy,
  206. strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf,
  207. gets. "Conservative" (_FORTIFY_SOURCE set to 1) only introduces
  208. checks that shouldn't change the behavior of conforming programs,
  209. while "aggressive" (_FORTIFY_SOURCES set to 2) some more checking is
  210. added, but some conforming programs might fail.
  211. config PKG_FORTIFY_SOURCE_NONE
  212. bool "None"
  213. config PKG_FORTIFY_SOURCE_1
  214. bool "Conservative"
  215. config PKG_FORTIFY_SOURCE_2
  216. bool "Aggressive"
  217. endchoice
  218. choice
  219. prompt "Enable RELRO protection"
  220. default PKG_RELRO_FULL
  221. help
  222. Enable a link-time protection known as RELRO (Relocation Read Only)
  223. which helps to protect from certain type of exploitation techniques
  224. altering the content of some ELF sections. "Partial" RELRO makes the
  225. .dynamic section not writeable after initialization, introducing
  226. almost no performance penalty, while "full" RELRO also marks the GOT
  227. as read-only at the cost of initializing all of it at startup.
  228. config PKG_RELRO_NONE
  229. bool "None"
  230. config PKG_RELRO_PARTIAL
  231. bool "Partial"
  232. config PKG_RELRO_FULL
  233. bool "Full"
  234. endchoice
  235. endmenu