wireguard-openbsd/share/mk/bsd.lib.mk, branch jd/queueboosts

The EXCLUDE_REGEX needs some tweaking for 6.6 and 6.7 syspatch builds.

2020-05-26T17:44:23Z

ok robert

new variable NOLIBSTATIC= prevents installation of a static library,

2019-04-02T12:55:05Z

in cases where you don't want it installed, or it isn't built. ok jsg

Remove commented-out historical ranlib operation, which would be

2019-04-02T11:30:07Z

duplicate work.

Remove -S from install commands

2019-02-24T12:57:13Z

As of usr.bin/xinstall/install.c revision 1.68, -S is a no-op and install(1) will always create files safely, thus clean the option usage from the tree. Diff from Lauri Tirkkonen , thanks.

when building syspatches with lld exclude more non-existent object files

2019-02-20T08:51:09Z

ok ajacoutot@, tb@

During build, delete all old library relink files to save disk space.

2019-02-11T17:53:00Z

It is not typical for "make build" to do pruning of the base system, but ... not sure where else we can do this ok kettenis

Define SOLIB when assembling for a shared-object library

2018-12-30T21:55:07Z

ok tedu@

Ensure that the install media are built with a consistent set of

2018-10-18T14:25:14Z

compiler flags. Pass DIST_CFLAGS from the crunchgen-generated .mk file. Compile the install media with -fno-unwind-tables to avoid emitting .eh_frame sections. This saves substantial space on amd64. with/ok kettenis@

Add RETGUARD to clang for amd64. This security mechanism uses per-function

2018-06-06T00:14:29Z

random cookies to protect access to function return instructions, with the effect that the integrity of the return address is protected, and function return instructions are harder to use in ROP gadgets. On function entry the return address is combined with a per-function random cookie and stored in the stack frame. The integrity of this value is verified before function return, and if this check fails, the program aborts. In this way RETGUARD is an improved stack protector, since the cookies are per-function. The verification routine is constructed such that the binary space immediately before each ret instruction is padded with int03 instructions, which makes these return instructions difficult to use in ROP gadgets. In the kernel, this has the effect of removing approximately 50% of total ROP gadgets, and 15% of unique ROP gadgets compared to the 6.3 release kernel. Function epilogues are essentially gadget free, leaving only the polymorphic gadgets that result from jumping into the instruction stream partway through other instructions. Work to remove these gadgets will continue through other mechanisms. Remaining work includes adding this mechanism to assembly routines, which must be done by hand. Many thanks to all those who helped test and provide feedback, especially deaadt, tb, espie and naddy. ok deraadt@

Set soname when building shared libraries.

2017-11-14T10:02:56Z

ok guenther@