[pkgsrc/trunk]: pkgsrc/mk/defaults Enable both SSP and FORTIFY by default

[khorben <khorben%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/f97f48e55ccd
branches:  trunk
changeset: 364833:f97f48e55ccd
user:      khorben <khorben%pkgsrc.org@localhost>
date:      Wed Jul 05 15:58:30 2017 +0000

description:
Enable both SSP and FORTIFY by default

This is only actually in use where known supported.

Prepared for a while, also the default in the base system (for NetBSD and
numerous others), introduced on mailing-lists and in my talk "Hardening
pkgsrc", and finally accepted unanimously during pkgsrcCon 2017.

Used by Joyent already (according to jperkin@) and tested in EdgeBSD for a
couple years now (amd64 and i386).

diffstat:

 mk/defaults/mk.conf |  10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diffs (44 lines):

diff -r c11836e03ea6 -r f97f48e55ccd mk/defaults/mk.conf
--- a/mk/defaults/mk.conf       Wed Jul 05 15:49:00 2017 +0000
+++ b/mk/defaults/mk.conf       Wed Jul 05 15:58:30 2017 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: mk.conf,v 1.276 2017/06/23 15:44:06 schmonz Exp $
+# $NetBSD: mk.conf,v 1.277 2017/07/05 15:58:30 khorben Exp $
 #
 
 # This file provides default values for variables that may be overridden
@@ -231,7 +231,7 @@
 # Possible: yes, no
 # Default: no
 
-PKGSRC_USE_FORTIFY?= no
+PKGSRC_USE_FORTIFY?= strong
 # Turns on substitute wrappers for commonly used functions that do not bounds
 # checking regularly, but could in some cases. This is effectively in use only
 # when both enabled and supported.
@@ -239,7 +239,7 @@
 #      no:     Do not pass any flags for FORTIFY
 #      weak:   Pass -D_FORTIFY_SOURCE=1
 #      strong: Pass -D_FORTIFY_SOURCE=2
-# Default: no
+# Default: strong
 
 PKGSRC_USE_RELRO?= no
 # Link with RELRO by default (on supported platforms). This makes the
@@ -249,14 +249,14 @@
 #      partial: Pass -Wl,-z,relro
 #      full:    Pass -Wl,-z,relro -Wl,-z,now
 
-PKGSRC_USE_SSP?= no
+PKGSRC_USE_SSP?= yes
 # Configure this to enable stack smashing protection (on supported platforms).
 # Possible values:
 #      no:     Do not pass any stack protection flags
 #      yes:    Pass -fstack-protector
 #      strong: Pass -fstack-protector-strong
 #      all:    Pass -fstack-protector-all
-# Default: no
+# Default: yes
 
 # The default PREFER_PKGSRC should be empty, but due to historical reasons we have the list below.
 # Please add your platform here once you have confirmed it is correct