stack protector: moved option out of adv menu

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

diff --git a/Config.in b/Config.in
index 62d67ce95772bd7853df008d65e491c0fb43aa98..e7e5c2d077e8d9b0e6aff18c74444df1321aefd7 100644 (file)
--- a/Config.in
+++ b/Config.in
@@ -567,61 +567,6 @@ config BR2_GOOGLE_BREAKPAD_INCLUDE_FILES
 
 endif
 
-choice
-       bool "build code with Stack Smashing Protection"
-       default BR2_SSP_ALL if BR2_ENABLE_SSP # legacy
-       depends on BR2_TOOLCHAIN_HAS_SSP
-       help
-         Enable stack smashing protection support using GCC's
-         -fstack-protector option family.
-
-         See
-         http://www.linuxfromscratch.org/hints/downloads/files/ssp.txt
-         for details.
-
-         Note that this requires the toolchain to have SSP support.
-         This is always the case for glibc and eglibc toolchain, but is
-         optional in uClibc toolchains.
-
-config BR2_SSP_NONE
-       bool "None"
-       help
-         Disable stack-smashing protection.
-
-config BR2_SSP_REGULAR
-       bool "-fstack-protector"
-       help
-         Emit extra code to check for buffer overflows, such as stack
-         smashing attacks. This is done by adding a guard variable to
-         functions with vulnerable objects. This includes functions
-         that call alloca, and functions with buffers larger than 8
-         bytes. The guards are initialized when a function is entered
-         and then checked when the function exits. If a guard check
-         fails, an error message is printed and the program exits.
-
-config BR2_SSP_STRONG
-       bool "-fstack-protector-strong"
-       depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
-       help
-         Like -fstack-protector but includes additional functions to be
-         protected - those that have local array definitions, or have
-         references to local frame addresses.
-
-comment "Stack Smashing Protection strong needs a toolchain w/ gcc >= 4.9"
-       depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
-
-config BR2_SSP_ALL
-       bool "-fstack-protector-all"
-       help
-         Like -fstack-protector except that all functions are
-         protected. This option might have a significant performance
-         impact on the compiled binaries.
-
-endchoice
-
-comment "Stack Smashing Protection needs a toolchain w/ SSP"
-       depends on !BR2_TOOLCHAIN_HAS_SSP
-
 choice
        bool "libraries"
        default BR2_SHARED_LIBS if BR2_BINFMT_SUPPORTS_SHARED
@@ -732,6 +677,63 @@ config BR2_REPRODUCIBLE
 
 endmenu
 
+comment "Security Hardening Options"
+
+choice
+       bool "Stack Smashing Protection"
+       default BR2_SSP_ALL if BR2_ENABLE_SSP # legacy
+       depends on BR2_TOOLCHAIN_HAS_SSP
+       help
+         Enable stack smashing protection support using GCC's
+         -fstack-protector option family.
+
+         See
+         http://www.linuxfromscratch.org/hints/downloads/files/ssp.txt
+         for details.
+
+         Note that this requires the toolchain to have SSP support.
+         This is always the case for glibc and eglibc toolchain, but is
+         optional in uClibc toolchains.
+
+config BR2_SSP_NONE
+       bool "None"
+       help
+         Disable stack-smashing protection.
+
+config BR2_SSP_REGULAR
+       bool "-fstack-protector"
+       help
+         Emit extra code to check for buffer overflows, such as stack
+         smashing attacks. This is done by adding a guard variable to
+         functions with vulnerable objects. This includes functions
+         that call alloca, and functions with buffers larger than 8
+         bytes. The guards are initialized when a function is entered
+         and then checked when the function exits. If a guard check
+         fails, an error message is printed and the program exits.
+
+config BR2_SSP_STRONG
+       bool "-fstack-protector-strong"
+       depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
+       help
+         Like -fstack-protector but includes additional functions to be
+         protected - those that have local array definitions, or have
+         references to local frame addresses.
+
+comment "Stack Smashing Protection strong needs a toolchain w/ gcc >= 4.9"
+       depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
+
+config BR2_SSP_ALL
+       bool "-fstack-protector-all"
+       help
+         Like -fstack-protector except that all functions are
+         protected. This option might have a significant performance
+         impact on the compiled binaries.
+
+endchoice
+
+comment "Stack Smashing Protection needs a toolchain w/ SSP"
+       depends on !BR2_TOOLCHAIN_HAS_SSP
+
 endmenu
 
 source "toolchain/Config.in"