Add support for a number of security features

- Revisit (and rename) support for FORTIFY as PKGSRC_USE_FORTIFY (instead
  of PKGSRC_USE_FORT) for easier support outside NetBSD/gcc;
- PKGSRC_USE_SSP is no longer enabled by default when PKGSRC_USE_FORTIFY
  is enabled;
- PKGSRC_MKPIE builds executables as PIE (to leverage userland ASLR)
- PKGSRC_USE_RELRO builds with a read-only GOT to prevent some exploits
  from functioning.

Tested on NetBSD/amd64 by myself, in every combination, with and without
pkgtools/cwrappers. MKPIE is not supported at the moment with cwrappers.
Also, MKPIE is known to still break a number of packages when enabled (and
actually supported).

Tested on SunOS by jperkin@, thank you!

As discussed on tech-pkg@, the default behavior is not changed, except
where noted above.

ok bsiegert@

1 files changed, 19 insertions, 9 deletions

diff --git a/mk/defaults/mk.conf b/mk/defaults/mk.conf
index 4d6e883bc91..568b72a6fa7 100644
--- a/mk/defaults/mk.conf
+++ b/mk/defaults/mk.conf
@@ -1,4 +1,4 @@
-# $NetBSD: mk.conf,v 1.262 2016/01/24 16:14:44 jperkin Exp $
+# $NetBSD: mk.conf,v 1.263 2016/03/11 23:03:31 khorben Exp $
 #
 
 # This file provides default values for variables that may be overridden
@@ -215,20 +215,30 @@ PKGSRC_RUN_TEST?=	no
 # Possible: yes, no
 # Default: no
 
-PKGSRC_USE_FORT?= no
+PKGSRC_MKPIE?= no
+# If no, create regular executables. Otherwise create PIE (Position Independent
+# Executables, on supported platforms). This option is necessary to fully
+# leverage ASLR as a mitigation for security vulnerabilities.
+# Possible: yes, no
+# Default: no
+
+PKGSRC_USE_FORTIFY?= no
 # Turns on substitute wrappers for commonly used functions that do not bounds
-# checking regularly, but could in some cases (with GCC for instance).
+# checking regularly, but could in some cases. This is effectively in use only
+# when both enabled and supported.
+# Possible: yes, no
+# Default: no
+
+PKGSRC_USE_RELRO?= no
+# Link with RELRO by default (on supported platforms). This makes the
+# exploitation of some security vulnerabilities more difficult in some cases.
 # Possible: yes, no
 # Default: no
 
-.if ${PKGSRC_USE_FORT:Uno} != "no"
-PKGSRC_USE_SSP?= yes
-.else
 PKGSRC_USE_SSP?= no
-.endif
-# Set this to YES to enable stack-smashing protection (on supported platforms).
+# Set this to yes to enable stack-smashing protection (on supported platforms).
 # Possible: yes, no
-# Default: no, except if PKGSRC_USE_FORT is set to "yes".
+# Default: no
 
 # The default PREFER_PKGSRC should be empty, but due to historical reasons we have the list below.
 # Please add your platform here once you have confirmed it is correct