!132 构建完善安全隐私合规

Merge pull request !132 from 孙旭辉/master

frameworks/common/BUILD.gn

@@ -33,7 +33,10 @@ config("app_domain_verify_frameworks_common_config") {
     "-Os",
   ]
 
-  cflags_cc = [ "-Os" ]
+  cflags_cc = [
+    "-fstack-protector-strong",
+    "-Os",
+  ]
 }
 
 ohos_shared_library("app_domain_verify_frameworks_common") {
@@ -72,9 +75,12 @@ ohos_shared_library("app_domain_verify_frameworks_common") {
     defines += [ "IS_RELEASE_VERSION" ]
   }
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"

frameworks/extension/BUILD.gn

@@ -31,7 +31,10 @@ config("app_domain_verify_extension_config") {
     "-Os",
   ]
 
-  cflags_cc = [ "-Os" ]
+  cflags_cc = [
+    "-fstack-protector-strong",
+    "-Os",
+  ]
 }
 
 config("app_domain_verify_extension_public_config") {
@@ -68,9 +71,12 @@ ohos_shared_library("app_domain_verify_extension_framework") {
     defines += [ "IS_RELEASE_VERSION" ]
   }
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"

frameworks/verifier/BUILD.gn

@@ -35,7 +35,10 @@ config("app_domain_verify_agent_verifier_config") {
     "-Os",
   ]
 
-  cflags_cc = [ "-Os" ]
+  cflags_cc = [
+    "-fstack-protector-strong",
+    "-Os",
+  ]
 }
 
 ohos_shared_library("app_domain_verify_agent_verifier") {
@@ -78,9 +81,12 @@ ohos_shared_library("app_domain_verify_agent_verifier") {
     defines += [ "IS_RELEASE_VERSION" ]
   }
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"

interfaces/inner_api/client/BUILD.gn

@@ -34,7 +34,10 @@ config("app_domain_verify_mgr_client_config") {
     "-Os",
   ]
 
-  cflags_cc = [ "-Os" ]
+  cflags_cc = [
+    "-fstack-protector-strong",
+    "-Os",
+  ]
 }
 
 config("app_domain_verify_agent_client_config") {
@@ -51,11 +54,16 @@ config("app_domain_verify_agent_client_config") {
     "-fdata-sections",
     "-ffunction-sections",
     "-Os",
+    "-fstack-protector-strong",
   ]
   if (!app_domain_verify_feature_target_from_cloud) {
     cflags += [ "-D_CUT_LINK_CONVERT_" ]
   }
-  cflags_cc = [ "-Os" ]
+
+  cflags_cc = [
+    "-fstack-protector-strong",
+    "-Os",
+  ]
 }
 
 ohos_shared_library("app_domain_verify_mgr_client") {
@@ -87,9 +95,12 @@ ohos_shared_library("app_domain_verify_mgr_client") {
   }
   version_script = "mgr.versionscript"
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"
@@ -119,9 +130,12 @@ ohos_shared_library("app_domain_verify_agent_client") {
     defines += [ "IS_RELEASE_VERSION" ]
   }
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"

interfaces/inner_api/common/BUILD.gn

@@ -30,7 +30,10 @@ config("app_domain_verify_common_config") {
     "-Os",
   ]
 
-  cflags_cc = [ "-Os" ]
+  cflags_cc = [
+    "-fstack-protector-strong",
+    "-Os",
+  ]
 }
 
 ohos_shared_library("app_domain_verify_common") {
@@ -62,9 +65,12 @@ ohos_shared_library("app_domain_verify_common") {
     defines += [ "IS_RELEASE_VERSION" ]
   }
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"

interfaces/kits/js/BUILD.gn

@@ -40,6 +40,16 @@ config("app_domain_verify_mgr_napi_config") {
 
 ohos_shared_library("appdomainverify_napi") {
   branch_protector_ret = "pac_ret"
+
+  sanitize = {
+    boundary_sanitize = true
+    cfi = true
+    cfi_cross_dso = true
+    debug = false
+    integer_overflow = true
+    ubsan = true
+  }
+
   sources = [
     "src/api_event_reporter.cpp",
     "src/app_domain_verify_manager_napi.cpp",

services/BUILD.gn

@@ -49,6 +49,7 @@ config("app_domain_verify_service_config") {
   cflags_cc = [
     "-fvisibility-inlines-hidden",
     "-Os",
+    "-fstack-protector-strong",
   ]
 }
 
@@ -105,9 +106,12 @@ ohos_shared_library("app_domain_verify_mgr_service") {
   ]
 
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"
@@ -148,6 +152,7 @@ config("app_domain_verify_agent_service_config") {
   cflags_cc = [
     "-fvisibility-inlines-hidden",
     "-Os",
+    "-fstack-protector-strong",
   ]
 }
 
@@ -196,9 +201,12 @@ ohos_shared_library("app_domain_verify_agent_service") {
   ]
 
   sanitize = {
+    boundary_sanitize = true
     cfi = true
     cfi_cross_dso = true
     debug = false
+    integer_overflow = true
+    ubsan = true
   }
   subsystem_name = "bundlemanager"
   part_name = "app_domain_verify"