Add support for a number of security features

- Revisit (and rename) support for FORTIFY as PKGSRC_USE_FORTIFY (instead
  of PKGSRC_USE_FORT) for easier support outside NetBSD/gcc;
- PKGSRC_USE_SSP is no longer enabled by default when PKGSRC_USE_FORTIFY
  is enabled;
- PKGSRC_MKPIE builds executables as PIE (to leverage userland ASLR)
- PKGSRC_USE_RELRO builds with a read-only GOT to prevent some exploits
  from functioning.

Tested on NetBSD/amd64 by myself, in every combination, with and without
pkgtools/cwrappers. MKPIE is not supported at the moment with cwrappers.
Also, MKPIE is known to still break a number of packages when enabled (and
actually supported).

Tested on SunOS by jperkin@, thank you!

As discussed on tech-pkg@, the default behavior is not changed, except
where noted above.

ok bsiegert@

4 files changed, 69 insertions, 3 deletions

diff --git a/mk/wrapper/arg-source b/mk/wrapper/arg-source
index 9336414edbf..476de2de56b 100644
--- a/mk/wrapper/arg-source
+++ b/mk/wrapper/arg-source
@@ -1,4 +1,4 @@
-# $NetBSD: arg-source,v 1.16 2015/11/20 05:49:24 richard Exp $
+# $NetBSD: arg-source,v 1.17 2016/03/11 23:03:31 khorben Exp $
 #
 # Copyright (c) 2004 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -161,6 +161,12 @@ while $test $# -gt 0; do
 	##############################################################
 	-c|-S|-E)
 		dont_link=yes
+		dont_link_binary=yes
+		append_queue argbuf "$arg"
+		$debug_log $wrapperlog "    (arg-source) push: $arg"
+		;;
+	-shared)
+		dont_link_binary=yes
 		append_queue argbuf "$arg"
 		$debug_log $wrapperlog "    (arg-source) push: $arg"
 		;;
diff --git a/mk/wrapper/bsd.wrapper.mk b/mk/wrapper/bsd.wrapper.mk
index 67d90d0fff2..887db29a08d 100644
--- a/mk/wrapper/bsd.wrapper.mk
+++ b/mk/wrapper/bsd.wrapper.mk
@@ -1,4 +1,4 @@
-# $NetBSD: bsd.wrapper.mk,v 1.96 2016/03/04 21:25:47 tnn Exp $
+# $NetBSD: bsd.wrapper.mk,v 1.97 2016/03/11 23:03:31 khorben Exp $
 #
 # Copyright (c) 2005 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -311,6 +311,9 @@ _WRAP_TRANSFORM.CXX=	${_WRAP_TRANSFORM.CC}
 .if !empty(PKGSRC_COMPILER:Mgcc)
 _WRAP_TRANSFORM.CC=	${WRAPPER_TMPDIR}/transform-gcc
 _WRAP_TRANSFORM.CXX=	${_WRAP_TRANSFORM.CC}
+. if ${_PKGSRC_MKPIE} != "no"
+_WRAP_CMD_SINK.CC=	${WRAPPER_TMPDIR}/cmd-sink-mkpie-gcc
+. endif
 .endif
 
 _WRAP_CMD_SINK.LD=		${WRAPPER_TMPDIR}/cmd-sink-ld
@@ -514,6 +517,7 @@ generate-wrappers: ${_target_}
 	cmd-sink-irix-ld \
 	cmd-sink-interix-gcc \
 	cmd-sink-ld \
+	cmd-sink-mkpie-gcc \
 	cmd-sink-osf1-cc \
 	cmd-sink-osf1-ld \
 	cmd-sink-hpux-cc \
diff --git a/mk/wrapper/cmd-sink-mkpie-gcc b/mk/wrapper/cmd-sink-mkpie-gcc
new file mode 100644
index 00000000000..8a1ed864d6d
--- /dev/null
+++ b/mk/wrapper/cmd-sink-mkpie-gcc
@@ -0,0 +1,47 @@
+# $NetBSD: cmd-sink-mkpie-gcc,v 1.1 2016/03/11 23:03:31 khorben Exp $
+#
+# Copyright (c) 2016 The NetBSD Foundation, Inc.
+# All rights reserved.
+#
+# This code is derived from software contributed to The NetBSD Foundation
+# by Pierre Pronchery.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+while ! queue_is_empty cmdbuf; do
+	pop_queue cmdbuf arg
+	$debug_log $wrapperlog "    (cmd-sink-mkpie-gcc) pop:  $arg"
+	case $arg in
+	*)
+		. $buildcmd
+		;;
+	esac
+done
+
+# Append any optional flags required when linking binaries.
+if $test "$dont_link_binary" != "yes"; then
+	# XXX obtain these flags from _MKPIE_LDFLAGS.gcc
+	for arg in -pie; do
+		$debug_log $wrapperlog "    (cmd-sink-mkpie-gcc) pop: $arg"
+		. $buildcmd
+	done
+fi
diff --git a/mk/wrapper/transform-gcc b/mk/wrapper/transform-gcc
index 3dd6624d7fb..cceabccb240 100644
--- a/mk/wrapper/transform-gcc
+++ b/mk/wrapper/transform-gcc
@@ -1,4 +1,4 @@
-# $NetBSD: transform-gcc,v 1.29 2013/12/31 13:56:35 tron Exp $
+# $NetBSD: transform-gcc,v 1.30 2016/03/11 23:03:31 khorben Exp $
 #
 # This file handles the transformations needed for gcc that can be done
 # looking at only one argument at a time.
@@ -43,10 +43,14 @@ case $arg in
 -fomit-frame-pointer	|\
 -fPIC			|\
 -fpic			|\
+-fPIE			|\
+-fpie			|\
 -fpcc-struct-return	|\
 -freg-struct-return	|\
 -frename-registers	|\
 -fsigned-char		|\
+-fstack-protector	|\
+-fstack-protector-all	|\
 -funroll-loops		|\
 -funsigned-char		|\
 -fweb			|\
@@ -74,6 +78,8 @@ case $arg in
 -print-search-dirs	|\
 -S			|\
 -shared			|\
+-shared-gcc		|\
+-shared-libgcc		|\
 -static			|\
 -std=c99		|\
 -std=gnu89		|\
@@ -90,6 +96,7 @@ case $arg in
 -Werror			|\
 -Werror-implicit-function-declaration |\
 -Wformat*		|\
+-Winline		|\
 -Wmissing-declarations	|\
 -Wmissing-format-attribute |\
 -Wmissing-prototypes	|\
@@ -110,12 +117,14 @@ case $arg in
 -Wno-write-strings	|\
 -Wparentheses		|\
 -Wpointer-arith		|\
+-Wredundant-decls	|\
 -Wreturn-type		|\
 -Wshadow		|\
 -Wsign-compare		|\
 -Wstrict-aliasing	|\
 -Wstrict-prototypes	|\
 -Wswitch		|\
+-Wtrigraphs		|\
 -Wunused		|\
 -Wundef			|\
 -Wwrite-strings		) transform_pass ;;