SSP support has been added to ports with WITH_SSP for i386 and amd64

on FreeBSD 10, and amd64 on earlier versions. SSP_UNSAFE is added to disable in a port if it fails to build, but this should only be used in rare circumstances such as kernel modules. Otherwise, the port may just be failing due to lack of respecting LDFLAGS. On FreeBSD 10, this uses an ldscript in /usr/lib/libc.so to pull in libssp_nonshared.a to address issues linking on i386 [1]. On earlier FreeBSD versions the WITH_SSP knob will add -lssp_nonshared to LDFLAGS on i386. This is not needed on amd64. However, several hundred ports do not currently respect LDFLAGS, so this support is disabled currently as it causes build failures if a dependency is looking for the stack_chk symbols. Many thanks to jlh@ for this as he had many years of patience in getting all of the necessary pieces [1][2] in. [1] http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup PR: ports/138228 [2] Submitted by: jlh (bsd.ssp.mk based on) Reviewed by: bapt With hat: portmgr exp-runs done: 37 over a month on 91i386,91amd64,10i386,10amd64
svn path=/head/; revision=327697
2013-09-20 12:54:54 +00:00 · 2013-09-20 12:54:54 +00:00 · c93dfc2e9f · 2021-03-31 03:12:20 +00:00
parent b10d5a64b7
commit c93dfc2e9f
61 changed files with 192 additions and 105 deletions
--- a/22
+++ b/22
@ -10,6 +10,28 @@ in the release notes and/or placed into UPDATING.

 All ports committers are allowed to commit to this file.

+20130920:
+AUTHOR: bdrewery@FreeBSD.org
+
+  SSP support has been added to ports with WITH_SSP for i386 and amd64
+  on FreeBSD 10, and amd64 on earlier versions.
+
+  SSP_UNSAFE is added to disable in a port if it fails to build, but
+  this should only be used in rare circumstances such as kernel modules.
+  Otherwise, the port may just be failing due to lack of respecting
+  LDFLAGS.
+
+  On FreeBSD 10, this uses an ldscript in /usr/lib/libc.so to pull in
+  libssp_nonshared.a to address issues linking on i386 [1].
+  
+  On earlier FreeBSD versions the WITH_SSP knob will add -lssp_nonshared
+  to LDFLAGS on i386. This is not needed on amd64. However, several hundred
+  ports do not currently respect LDFLAGS, so this support is disabled currently
+  as it causes build failures if a dependency is looking for the stack_chk
+  symbols.
+
+  [1] http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup
+
 20130919:
 AUTHOR: gahr@FreeBSD.org

--- a/Mk/bsd.port.mk
+++ b/Mk/bsd.port.mk
@ -301,6 +301,13 @@ FreeBSD_MAINTAINER=	portmgr@FreeBSD.org
 #                         passed to the compiler by setting DEBUG_FLAGS. It is
 #                         set to "-g" at default.
 #
+# WITH_SSP		- If set, SSP_FLAGS (defaults to -fstack-protector)
+#				  is added to CFLAGS and the necessary flags
+#				  are added to LDFLAGS. Note that SSP_UNSAFE
+#				  can be used in Makefiles by port maintainers
+#				  if a port breaks with it (it should be
+#				  extremely rare).
+#
 # USE_BZIP2		- If set, this port tarballs use bzip2, not gzip, for
 #				  compression.
 # USE_LHA		- If set, this port distfile uses lha for compression
@ -1563,6 +1570,10 @@ DEBUG_FLAGS?=	-g
 CFLAGS:=		${CFLAGS:N-O*:N-fno-strict*} ${DEBUG_FLAGS}
 .endif

+.if defined(WITH_SSP)
+.include "${PORTSDIR}/Mk/bsd.ssp.mk"
+.endif
+
 .if defined(NOPORTDOCS)
 PLIST_SUB+=		PORTDOCS="@comment "
 .else
--- a/Mk/bsd.ssp.mk
+++ b/Mk/bsd.ssp.mk
@ -0,0 +1,30 @@
+# $FreeBSD$
+# SSP Support
+
+SSP_Include_MAINTAINER=	portmgr@FreeBSD.org
+
+# See: http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup
+.if ${OSVERSION} < 1000036 && ${ARCH} == i386
+
+# Disabled on i386 for now on releases without the ldscript as too many ports
+# do not respect LDFLAGS and fail to build due to not adding in -lssp_nonshared when needed
+# despite dependencies working fine, which breaks a lot. Can enable once LDFLAGS is more
+# supported. XXX
+SSP_UNSAFE=		yes
+
+# i386 needs -lssp_nonshared, see svn link above for more information
+SSP_NEED_NONSHARED=	yes
+.endif
+
+.if defined(WITH_SSP) && !defined(WITHOUT_SSP) && !defined(SSP_UNSAFE) && \
+    (${ARCH} == i386 || ${ARCH} == amd64)
+# Overridable as a user may want to use -fstack-protector-all
+SSP_CFLAGS?=	-fstack-protector
+CFLAGS:=	${CFLAGS} ${SSP_CFLAGS}
+LDFLAGS:=	${LDFLAGS} -fstack-protector
+# -lssp_nonshared is needed on i386 where /usr/lib/libc.so is not an ldscript
+# This is currently unused XXX
+.	if defined(SSP_NEED_NONSHARED)
+LDFLAGS:=	${LDFLAGS} -lssp_nonshared
+.	endif
+.endif
--- a/24
+++ b/24
@ -5,6 +5,30 @@ they are unavoidable.
 You should get into the habit of checking this file for changes each time
 you update your ports collection, before attempting any port upgrades.

+20130920:
+  AFFECTS: Users of ports
+  AUTHOR: bdrewery@FreeBSD.org
+
+  Optional Stack Protector [1] support has been added with the WITH_SSP
+  knob.
+
+  This currently is only supported on FreeBSD 10 amd64/i386 and earlier
+  releases on amd64 only.
+
+  The default SSP_CLFAGS is -fstack-protector, but -fstack-protector-all
+  may optionally be set instead.
+
+  To enable support, add WITH_SSP=yes to your make.conf and rebuild all
+  ports.
+
+  # portmaster -af
+
+  or
+
+  # portupgrade -af
+
+  [1] https://en.wikipedia.org/wiki/Buffer_overflow_protection
+
 20130904:
  AFFECTS: 10-CURRENT users with any port depending on converters/libiconv
  AUTHOR: madpilot@FreeBSD.org
--- a/audio/csound/Makefile
+++ b/audio/csound/Makefile
@ -35,6 +35,7 @@ FLTK_DESC=	Build FLTK plugin and GUI

 CONFLICTS_INSTALL=	outguess-*

+SSP_UNSAFE=	yes
 USE_PYTHON=	2.6+
 USES=		bison gettext
 USE_SCONS=	yes
--- a/audio/emu10kx/Makefile
+++ b/audio/emu10kx/Makefile
@ -1,9 +1,5 @@
-# Ports collection makefile for: emu10kx
-# Date created:  7 Aug 2005
-# Whom: michaels@sdf.lonestar.org
-#
+# Created by: michaels@sdf.lonestar.org
 # $FreeBSD$
-#

 PORTNAME=	emu10kx
 PORTVERSION=	20051021
@ -17,6 +13,7 @@ COMMENT=	SBLive!, Audigy, and Audigy2 driver for FreeBSD
 USE_BZIP2=	yes

 NO_PACKAGE=	should be recompiled for a particular FreeBSD kernel
+SSP_UNSAFE=	kernel module does not support ssp

 MAN8=	emuctrl.8
 PLIST_FILES=	sbin/emuctrl etc/rc.d/emuctrl.sh
--- a/audio/oss/Makefile
+++ b/audio/oss/Makefile
@ -14,6 +14,7 @@ LICENSE=	BSD

 BUILD_DEPENDS=	gawk:${PORTSDIR}/lang/gawk

+SSP_UNSAFE=	kernel module does not support ssp
 USE_BZIP2=	yes
 ALL_TARGET=	all install
 USE_GNOME=	gtk20
--- a/comms/uarduno/Makefile
+++ b/comms/uarduno/Makefile
@ -11,6 +11,8 @@ COMMENT=	FreeBSD Kernel Driver for the Arduino Uno USB interface

 NO_PACKAGE=	You must (re)build this port with your kernel source

+SSP_UNSAFE=	kernel module does not support ssp
+
 # need to enforce installation into kernel module directory
 MAKE_ENV+=	KMODDIR=${KMODDIR}
 PREFIX=		${KMODDIR}
--- a/comms/uartlirc/Makefile
+++ b/comms/uartlirc/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	uarlirc
-# Date created:				Sun May 13 17:39:40 CEST 2012
-# Whom:					nox@FreeBSD.org
-#
+# Created by: nox@FreeBSD.org
 # $FreeBSD$
-#

 PORTNAME=	uartlirc
 PORTVERSION=	0.3
@ -17,6 +13,8 @@ EXTRACT_SUFX=	.shar
 MAINTAINER=	nox@FreeBSD.org
 COMMENT=	Driver for "homebrew" serial LIRC receivers

+SSP_UNSAFE=	kernel module does not support ssp
+
 WRKSRC=		${WRKDIR}/${PORTNAME}
 EXTRACT_CMD=	${SH}
 EXTRACT_BEFORE_ARGS=
--- a/devel/libtecla/Makefile
+++ b/devel/libtecla/Makefile
@ -1,10 +1,5 @@
-# ex:ts=8
-# New ports collection makefile for:	libtecla
-# Date created:		Feb 12, 2001
-# Whom:			Ying-Chieh Liao <ijliao@FreeBSD.org>
-#
+# Created by: Ying-Chieh Liao <ijliao@FreeBSD.org>
 # $FreeBSD$
-#

 PORTNAME=	libtecla
 PORTVERSION=	1.6.2
@ -25,6 +20,7 @@ SCRIPTS_ENV=	WRKDIRPREFIX="${WRKDIRPREFIX}" \
 		REALCURDIR="${.CURDIR}" \
 		PORTNAME="${PORTNAME}"
 MAKE_JOBS_UNSAFE=	yes
+SSP_UNSAFE=	yes

 .include <bsd.port.pre.mk>

--- a/devel/mingw32-gcc/Makefile
+++ b/devel/mingw32-gcc/Makefile
@ -20,6 +20,8 @@ LIB_DEPENDS=	gmp:${PORTSDIR}/math/gmp \

 GCCVERSION=	4.7.2

+SSP_UNSAFE=	yes
+
 ONLY_FOR_ARCHS=	amd64 i386 powerpc powerpc64 sparc64
 USE_LDCONFIG=	yes
 USES=		bison iconv gmake perl5
--- a/dns/c-ares/Makefile
+++ b/dns/c-ares/Makefile
@ -13,6 +13,8 @@ COMMENT=	An asynchronous DNS resolver library

 LICENSE=	MIT

+SSP_UNSAFE=	Refuses -l in LDFLAGS
+
 OPTIONS_DEFINE=		CONFIG_INFO DEBUG HIDE_SYMBOLS OPTIMIZED_CFLAGS
 OPTIONS_DEFAULT=	CONFIG_INFO HIDE_SYMBOLS

--- a/editors/emacs21/Makefile
+++ b/editors/emacs21/Makefile
@ -21,6 +21,8 @@ CONFLICTS=	emacs-19.* emacs-22.* emacs-23.* emacs-24.* \
 		xemacs-[0-9]* xemacs-devel-[0-9]* \
 		xemacs-mule-[0-9]* xemacs-devel-mule-[0-9]*

+SSP_UNSAFE=	yes
+
 .if !defined(WITHOUT_X11)
 LIB_DEPENDS=	Xaw3d:${PORTSDIR}/x11-toolkits/Xaw3d \
 		jpeg.11:${PORTSDIR}/graphics/jpeg \
--- a/emulators/kqemu-kmod-devel/Makefile
+++ b/emulators/kqemu-kmod-devel/Makefile
@ -19,6 +19,8 @@ COMMENT=	Kernel Accelerator for QEMU CPU Emulator (development version)
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/COPYING

+SSP_UNSAFE=	kernel module does not support ssp
+
 ONLY_FOR_ARCHS=	i386 amd64
 HAS_CONFIGURE=	yes
 USE_GMAKE=	yes
--- a/emulators/kqemu-kmod/Makefile
+++ b/emulators/kqemu-kmod/Makefile
@ -19,6 +19,8 @@ COMMENT=	Kernel Accelerator for QEMU CPU Emulator
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/COPYING

+SSP_UNSAFE=	kernel module does not support ssp
+
 ONLY_FOR_ARCHS=	i386 amd64
 HAS_CONFIGURE=	yes
 USE_GMAKE=	yes
--- a/emulators/open-vm-tools/Makefile
+++ b/emulators/open-vm-tools/Makefile
@ -24,6 +24,8 @@ USES=			pkgconfig
 USE_LDCONFIG=		yes
 CPPFLAGS+=		-Wno-deprecated-declarations

+SSP_UNSAFE=		kernel module does not support ssp
+
 CONFIGURE_ARGS+=	--without-procps --sysconfdir=${LOCALBASE}/etc
 .if defined(WITHOUT_X11)
 LIB_DEPENDS+=		glib-2.0:${PORTSDIR}/devel/glib20
--- a/emulators/parallels-tools/Makefile
+++ b/emulators/parallels-tools/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	parallels-tools
-# Date created:		14 Jun 2009
-# Whom:			Alexander Nedotsukov <bland@FreeBSD.org>
-#
+# Created by: Alexander Nedotsukov <bland@FreeBSD.org>
 # $FreeBSD$
-#

 PORTNAME=	parallels-tools
 PORTVERSION=	0.1.1
@ -14,6 +10,7 @@ MASTER_SITE_SUBDIR=	bland
 MAINTAINER=	bland@FreeBSD.org
 COMMENT=	Parallels Desktop Tools for FreeBSD

+SSP_UNSAFE=	kernel module does not support ssp
 USE_BZIP2=	yes

 ONLY_FOR_ARCHS=	amd64 i386
--- a/emulators/rtc/Makefile
+++ b/emulators/rtc/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	rtc
-# Date created:		28 March 2000
-# Whom:			Akinori MUSHA aka knu <knu@idaemons.org>
-#
+# Created by: Akinori MUSHA aka knu <knu@idaemons.org>
 # $FreeBSD$
-#

 PORTNAME=	rtc
 PORTVERSION=	2004.02.24.1
@ -17,6 +13,7 @@ COMMENT=	Kernel module which provides /dev/rtc device support

 WRKSRC=		${WRKDIR}/files

+SSP_UNSAFE=	kernel module does not support ssp
 NO_FETCH=	yes
 USE_LINUX=	yes	# because of ${DEVDIR}

--- a/ftp/curl-hiphop/Makefile
+++ b/ftp/curl-hiphop/Makefile
@ -1,15 +1,13 @@
-# New ports collection makefile for:	curl-hiphop
-# Date created:		16 July 2012
-# Whom:			Martin Matuska <mm@FreeBSd.org>
-#
+# Created by: Martin Matuska <mm@FreeBSD.org>
 # $FreeBSD$
-#

 PKGNAMESUFFIX=	-hiphop

 MAINTAINER=	mm@FreeBSD.org
 COMMENT=	Static libcurl with custom patches for HipHop

+SSP_UNSAFE=	Refuses -l in LDFLAGS
+
 BUILDING_HIPHOP=	yes

 HIPHOP_DIR=	share/hiphop-php
--- a/ftp/curl/Makefile
+++ b/ftp/curl/Makefile
@ -14,6 +14,8 @@ COMMENT?=	Non-interactive tool to get files from FTP, GOPHER, HTTP(S) servers

 LICENSE=	MIT

+SSP_UNSAFE=	Refuses -l in LDFLAGS
+
 OPTIONS_DEFINE=	CA_BUNDLE COOKIES CURL_DEBUG DEBUG DOCS EXAMPLES GSSAPI IDN IPV6 LDAP LDAPS LIBSSH2 NTLM PROXY RTMP SPNEGO TLS_SRP
 OPTIONS_RADIO=	RESOLV SSL
 OPTIONS_RADIO_RESOLV=	CARES THREADED_RESOLVER
--- a/games/gtkradiant/Makefile
+++ b/games/gtkradiant/Makefile
@ -20,6 +20,7 @@ LIB_DEPENDS=	libgtkglext-x11-1.0.so:${PORTSDIR}/x11-toolkits/gtkglext \
 		libmhash.so:${PORTSDIR}/security/mhash \
 		libpng15.so:${PORTSDIR}/graphics/png

+SSP_UNSAFE=	yes
 USES=		pkgconfig
 USE_ZIP=	yes
 USE_GNOME=	gtk20 libxml2
--- a/graphics/kix-kmod/Makefile
+++ b/graphics/kix-kmod/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	kix-kmod
-# Date created:				4 January 2003
-# Whom:					Jonathan Belson <jon@witchspace.com>
-#
+# Created by: Jonathan Belson <jon@witchspace.com>
 # $FreeBSD$
-#

 PORTNAME=       kix
 PORTVERSION=	1.0
@ -16,6 +12,8 @@ PKGNAMESUFFIX=	-kmod
 MAINTAINER=	jon@witchspace.com
 COMMENT=	A graphical screensaver kernel module

+SSP_UNSAFE=	kernel module does not support ssp
+
 .include <bsd.port.pre.mk>

 SYSDIR?=	${SRC_BASE}/sys
--- a/graphics/plasma-kmod/Makefile
+++ b/graphics/plasma-kmod/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	plasma-kmod
-# Date created:				24 January 2001
-# Whom:					George Reid <greid@ukug.uk.freebsd.org>
-#
+# Created by: George Reid <greid@ukug.uk.freebsd.org>
 # $FreeBSD$
-#

 PORTNAME=	plasma
 PORTVERSION=	0.1
@ -17,6 +13,8 @@ COMMENT=	A plasma-effect screensaver kernel module

 LICENSE=	BSD

+SSP_UNSAFE=	kernel module does not support ssp
+
 .include <bsd.port.pre.mk>

 .if !exists(${SRC_BASE}/sys/dev/syscons/syscons.h)
--- a/lang/gcc/Makefile
+++ b/lang/gcc/Makefile
@ -32,6 +32,7 @@ USES=		bison gmake iconv perl5
 USE_BINUTILS=	yes
 USE_BZIP2=	yes
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/gcc34/Makefile
+++ b/lang/gcc34/Makefile
@ -21,6 +21,7 @@ LATEST_LINK=	gcc${SUFFIX}${PKGNAMESUFFIX}
 USES=		bison gmake iconv perl5
 USE_BZIP2=	yes
 USE_PERL=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:C/${WRKDIR}//}/configure
--- a/lang/gcc42/Makefile
+++ b/lang/gcc42/Makefile
@ -27,6 +27,7 @@ USES=		bison gmake iconv perl5
 USE_BZIP2=	yes
 USE_CSTD=	gnu89
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/gcc44/Makefile
+++ b/lang/gcc44/Makefile
@ -25,6 +25,7 @@ USE_BINUTILS=	yes
 USES=		bison gmake iconv perl5
 USE_BZIP2=	yes
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/gcc46/Makefile
+++ b/lang/gcc46/Makefile
@ -34,6 +34,7 @@ USES=		bison gmake iconv perl5
 USE_BINUTILS=	yes
 USE_BZIP2=	yes
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/gcc47/Makefile
+++ b/lang/gcc47/Makefile
@ -33,6 +33,7 @@ USES=		bison gmake iconv perl5
 USE_BINUTILS=	yes
 USE_BZIP2=	yes
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/gcc48/Makefile
+++ b/lang/gcc48/Makefile
@ -33,6 +33,7 @@ USES=		bison gmake iconv perl5
 USE_BINUTILS=	yes
 USE_BZIP2=	yes
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/gcc49/Makefile
+++ b/lang/gcc49/Makefile
@ -33,6 +33,7 @@ USES=		gmake iconv perl5
 USE_BINUTILS=	yes
 USE_BZIP2=	yes
 USE_PERL5=	build
+SSP_UNSAFE=	yes

 PATCH_WRKSRC=	${SRCDIR}
 CONFIGURE_SCRIPT=	../${SRCDIR:S/${WRKDIR}\///}/configure
--- a/lang/libobjc2/Makefile
+++ b/lang/libobjc2/Makefile
@ -9,6 +9,8 @@ MASTER_SITES=	http://download.gna.org/gnustep/
 MAINTAINER=	theraven@FreeBSD.org
 COMMENT=	Replacement Objective-C runtime supporting modern Objective-C features

+SSP_UNSAFE=	yes
+
 .include <bsd.port.options.mk>

 USES=		cmake
--- a/lang/ocaml/Makefile
+++ b/lang/ocaml/Makefile
@ -20,6 +20,7 @@ REINPLACE_ARGS=	-i ""
 HAS_CONFIGURE=	yes
 ALL_TARGET=	world.opt
 STRIP=
+SSP_UNSAFE=	yes
 MAKE_JOBS_UNSAFE=	yes

 CONFIGURE_ARGS=	-verbose -prefix "${PREFIX}" -cc "${CC}" -as "${AS}" \
--- a/misc/dahdi-kmod/Makefile
+++ b/misc/dahdi-kmod/Makefile
@ -1,9 +1,5 @@
-# Ports collection makefile for:	dahdi
-# Date created:				3 Mar 2010
-# Whom:					Maxim Khon <fjoe@FreeBSD.org>
-#
+# Created by: Maxim Khon <fjoe@FreeBSD.org>
 # $FreeBSD$
-#

 PORTNAME=	dahdi-kmod
 PORTVERSION=	${DAHDI_VERSION:S/-//g}
@ -22,6 +18,8 @@ COMMENT=	Digium/Asterisk Hardware Device Interface

 RUN_DEPENDS=	${LOCALBASE}/sbin/dahdi_cfg:${PORTSDIR}/misc/dahdi

+SSP_UNSAFE=	kernel module does not support ssp
+
 DAHDI_VERSION=		2.4.0-rc5
 DAHDI_TOOLS_VERSION=	2.4.0-rc1
 OSLEC_VERSION=		2.6.35.4
--- a/misc/dahdi-kmod26/Makefile
+++ b/misc/dahdi-kmod26/Makefile
@ -1,9 +1,5 @@
-# Ports collection makefile for:	dahdi
-# Date created:				3 Mar 2010
-# Whom:					Maxim Khon <fjoe@FreeBSD.org>
-#
+# Created by: Maxim Khon <fjoe@FreeBSD.org>
 # $FreeBSD$
-#

 PORTNAME=	dahdi-kmod26
 PORTVERSION=	${DAHDI_VERSION:S/-/./g}
@ -22,6 +18,8 @@ COMMENT=	Digium/Asterisk Hardware Device Interface

 RUN_DEPENDS=	${LOCALBASE}/sbin/dahdi_cfg:${PORTSDIR}/misc/dahdi

+SSP_UNSAFE=	kernel module does not support ssp
+
 DAHDI_VERSION=		2.6.1-r10738
 DAHDI_TOOLS_VERSION=	2.4.0-rc1
 OSLEC_VERSION=		2.6.35.4
--- a/multimedia/cuse4bsd-kmod/Makefile
+++ b/multimedia/cuse4bsd-kmod/Makefile
@ -11,6 +11,7 @@ COMMENT=	Cuse4BSD character device loopback driver for userspace

 CONFLICTS=	video4bsd-kmod*

+SSP_UNSAFE=	kernel module does not support ssp
 USE_BZIP2=	yes

 KMODDIR=	/boot/modules
--- a/multimedia/cx88/Makefile
+++ b/multimedia/cx88/Makefile
@ -18,6 +18,7 @@ KMODDIR=	/boot/modules
 PLIST_SUB+=	KMODDIR=${KMODDIR}
 MAKE_ARGS+=	LIBTUNER_LIB=${LOCALBASE}/lib/libtuner LIBTUNER_HEADER=${LOCALBASE}/include/libtuner KMODDIR=${KMODDIR}
 MAKE_JOBS_UNSAFE=	yes
+SSP_UNSAFE=	kernel module does not support ssp

 OPTIONS_DEFINE=	DEBUG LINUX_COMPAT HAL

--- a/multimedia/linux_dvbwrapper-kmod/Makefile
+++ b/multimedia/linux_dvbwrapper-kmod/Makefile
@ -10,6 +10,7 @@ DISTFILES=	# none
 MAINTAINER=	nox@FreeBSD.org
 COMMENT=	Linux compatibility layer - DVB ioctl handler

+SSP_UNSAFE=	kernel module does not support ssp
 ONLY_FOR_ARCHS=	i386 amd64

 .include <bsd.port.pre.mk>
--- a/multimedia/ptx-kmod/Makefile
+++ b/multimedia/ptx-kmod/Makefile
@ -13,6 +13,8 @@ COMMENT=	Device driver for PT1/PT2 ISDB-S/T tuner cards

 LICENSE=	GPLv3

+SSP_UNSAFE=	kernel module does not support ssp
+
 ONLY_FOR_ARCHS=	amd64 i386
 BUILD_WRKSRC=	${WRKSRC}/dev/ptx
 MAKE_ENV=	KMODDIR=${PREFIX}/${KMODDIR} SYSDIR=${SYSDIR}
--- a/multimedia/pwcbsd/Makefile
+++ b/multimedia/pwcbsd/Makefile
@ -15,6 +15,8 @@ COMMENT=	The Linux pwc webcam driver ported to FreeBSD

 CONFLICTS=	pwcview-[0-9]*

+SSP_UNSAFE=	kernel module does not support ssp
+
 MAN4=		pwc.4

 WRKSRC=		${WRKDIR}/${PORTNAME}
--- a/net-mgmt/netams/Makefile
+++ b/net-mgmt/netams/Makefile
@ -12,6 +12,7 @@ COMMENT=	Network Traffic Accounting and Monitoring Software

 LIB_DEPENDS=	pcap.1:${PORTSDIR}/net/libpcap

+SSP_UNSAFE=	kernel module does not support ssp
 USE_SUBMAKE=	yes
 SUB_FILES=	pkg-message
 USE_RC_SUBR=	netams
--- a/net/aoe/Makefile
+++ b/net/aoe/Makefile
@ -1,13 +1,9 @@
-# Ports collection makefile for:	aoe (ATA Over Ethernet) driver
-# Date created:				22 May 2006
-# Whom:					Stacey D. Son <sds@son.org>
-#
+# Created by: Stacey D. Son <sds@son.org>
 # $FreeBSD$
-#

 PORTNAME=	aoe
 PORTVERSION=	1.2.0
-CATEGORIES=	net
+CATEGORIES=	net kld
 MASTER_SITES=	http://www.son.org/download/
 DISTNAME=	${PORTNAME}-freebsd-${PORTVERSION}

@ -15,6 +11,7 @@ MAINTAINER=	fjoe@FreeBSD.org
 COMMENT=	FreeBSD driver for ATA over Ethernet (AoE)

 NO_PACKAGE=	Should be in sync with the kernel to work correctly
+SSP_UNSAFE=	kernel module does not support ssp

 WRKSRC=		${WRKDIR}/dev/aoe
 MAN4=		aoe.4
--- a/net/etherboot/Makefile
+++ b/net/etherboot/Makefile
@ -9,6 +9,7 @@ MASTER_SITES=	SF http://etherboot.berlios.de/dist/
 MAINTAINER=	ambrisko@FreeBSD.org
 COMMENT=	Network boot of FreeBSD a.out/ELF kernels (improved netboot)

+SSP_UNSAFE=	yes
 ONLY_FOR_ARCHS=	i386
 NO_PACKAGE=	lots of configuration necessary

--- a/net/iet/Makefile
+++ b/net/iet/Makefile
@ -4,7 +4,7 @@
 PORTNAME=	iet
 PORTVERSION=	1.4.20.2
 PORTREVISION=	6
-CATEGORIES=	net
+CATEGORIES=	net kld
 MASTER_SITES=	SF/iscsitarget/iscsitarget/${PORTVERSION}/
 DISTNAME=	iscsitarget-${PORTVERSION}

@ -18,6 +18,7 @@ COMMENT=	The iSCSI Enterprise Target

 LICENSE=	GPLv2

+SSP_UNSAFE=	kernel module does not support ssp
 BUILD_WRKSRC=	${WRKSRC}/freebsd
 INSTALL_WRKSRC=	${BUILD_WRKSRC}

--- a/net/ng_daphne/Makefile
+++ b/net/ng_daphne/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	ng_daphne
-# Date created:		8 November 2003
-# Whom:			Gerasimos Dimitriadis
-#
+# Created by: Gerasimos Dimitriadis
 # $FreeBSD$
-#

 PORTNAME=	ng_daphne
 PORTVERSION=	1.0
@ -15,6 +11,8 @@ MASTER_SITES=	http://newton.ee.auth.gr/ng_daphne/ \
 MAINTAINER=	gedimitr@auth.gr
 COMMENT=	A simple netgraph module for multihop ad hoc networks

+SSP_UNSAFE=	kernel module does not support ssp
+
 .include <bsd.port.pre.mk>

 SYSDIR?=	${SRC_BASE}/sys
--- a/net/ng_mikrotik_eoip/Makefile
+++ b/net/ng_mikrotik_eoip/Makefile
@ -12,6 +12,8 @@ COMMENT=	Netgraph node for Mikrotik EoIP tunneling

 LICENSE=	BSD

+SSP_UNSAFE=	kernel module does not support ssp
+
 OPTIONS_DEFINE=	PTABLE	
 PTABLE_DESC=	Use O(1) lookup for tunnel hooks
 # This option enables usage of static pointer table to find needed decimal-named hook,
--- a/net/skyfish/Makefile
+++ b/net/skyfish/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:   skyfish
-# Date created:        23 May 2008
-# Whom:                Nsand <nsand@sura.ru>
-#
+# Created by: Nsand <nsand@sura.ru>
 # $FreeBSD$
-#

 PORTNAME=	skyfish
 PORTVERSION=	0.91
@ -13,6 +9,8 @@ MASTER_SITES=	ftp://ftp.lissyara.su/users/nsand/skyfish/
 MAINTAINER=	nsand@sura.ru
 COMMENT=	Grabbing TCP streams from network interface (SAT internet)

+SSP_UNSAFE=	kernel module does not support ssp
+
 .include <bsd.port.pre.mk>

 SYSDIR?=	${SRC_BASE}/sys
--- a/net/userfw/Makefile
+++ b/net/userfw/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:   userfw
-# Date created:        10 Mar 2012
-# Whom:                Maxim Ignatenko
-#
+# Created by: Maxim Ignatenko
 # $FreeBSD$
-#

 PORTNAME=	userfw
 PORTVERSION=	0.1.3
@ -17,6 +13,7 @@ COMMENT=	Modular packet filter

 LICENSE=	BSD

+SSP_UNSAFE=	kernel module does not support ssp
 USE_XZ=		yes
 USES=		cmake:outsource
 USE_LDCONFIG=	yes
--- a/print/acroreadwrapper/Makefile
+++ b/print/acroreadwrapper/Makefile
@ -1,13 +1,9 @@
-# New ports collection makefile for:	acroreadwrapper
-# Date created:		20 February 2006
-# Whom:			hrs
-#
+# Created by: hrs
 # $FreeBSD$
-#

 PORTNAME=	acroreadwrapper
 PORTVERSION=	0.0.20130208
-CATEGORIES=	print
+CATEGORIES=	print kld
 MASTER_SITES=	http://people.allbsd.org/~hrs/FreeBSD/
 DISTNAME=	linux_adobe_kmod-${PORTVERSION:E}

@ -18,6 +14,8 @@ LICENSE=	BSD

 RUN_DEPENDS=	${LOCALBASE}/lib/linux-libgtkembedmoz/libgtkembedmoz.so:${PORTSDIR}/www/linux-libgtkembedmoz

+SSP_UNSAFE=	kernel module does not support ssp
+
 ONLY_FOR_ARCHS=	amd64 i386
 PLIST_FILES=	bin/acroread8 bin/acroread9 bin/acroread \
 		${KMODDIR}/linux_adobe.ko
--- a/security/quantis-kmod/Makefile
+++ b/security/quantis-kmod/Makefile
@ -17,6 +17,7 @@ LICENSE=	BSD GPLv2
 LICENSE_COMB=	dual
 LICENSE_FILE=	${WRKDIR}/Quantis-${DISTVERSION}/License.txt

+SSP_UNSAFE=	kernel module does not support ssp
 USE_ZIP=	yes
 EXTRACT_BEFORE_ARGS=	-aqo

--- a/sysutils/acpi_call/Makefile
+++ b/sysutils/acpi_call/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	acpi_call
-# Date created:				15 Oct 2011
-# Whom:					Maxim Ignatenko
-#
+# Created by: Maxim Ignatenko
 # $FreeBSD$
-#

 PORTNAME=	acpi_call
 PORTVERSION=	1.0.1
@ -16,6 +12,8 @@ COMMENT=	Kernel module for calling ACPI methods from userspace

 LICENSE=	BSD

+SSP_UNSAFE=	kernel module does not support ssp
+
 .include <bsd.port.pre.mk>

 KMODDIR?=	/boot/modules
--- a/sysutils/biosfont/Makefile
+++ b/sysutils/biosfont/Makefile
@ -11,6 +11,8 @@ COMMENT=	Kernel module to retrieve bitmap fonts from BIOS memory

 LICENSE=	BSD

+SSP_UNSAFE=	kernel module does not support ssp
+
 # only platforms guraranteed to be ok, feedback/patches are welcome
 ONLY_FOR_ARCHS=	i386 amd64

--- a/sysutils/fusefs-kmod/Makefile
+++ b/sysutils/fusefs-kmod/Makefile
@ -17,6 +17,8 @@ COMMENT=	Kernel module for fuse

 BUILD_DEPENDS=	fusefs-libs>2.4.1:${PORTSDIR}/sysutils/fusefs-libs

+SSP_UNSAFE=	kernel module does not support ssp
+
 USE_RC_SUBR=	fusefs
 KMODDIR?=	${PREFIX}/modules
 PLIST_SUB=	KMODDIR=${KMODDIR}
--- a/sysutils/graid5/Makefile
+++ b/sysutils/graid5/Makefile
@ -1,9 +1,5 @@
-# New ports collection makefile for:	graid5
-# Date created:				09 Nov 2010
-# Whom:					Lev Serebryakov <lev@FreeBSD.org>
-#
+# Created by: Lev Serebryakov <lev@FreeBSD.org>
 # $FreeBSD$
-#

 PORTNAME=	graid5
 PORTVERSION=	${MAINVERSION}.${VERSIONDATE}
@ -14,6 +10,7 @@ MASTER_SITES=	http://lev.serebryakov.spb.ru/download/graid5/
 MAINTAINER=	lev@FreeBSD.org
 COMMENT=	RAID5 geom class

+SSP_UNSAFE=	kernel module does not support ssp
 USE_BZIP2=	yes

 NO_PACKAGE=	should be recompiled for a particular FreeBSD kernel
--- a/sysutils/grub2/Makefile
+++ b/sysutils/grub2/Makefile
@ -17,6 +17,7 @@ BUILD_DEPENDS=	${LOCALBASE}/bin/flex:${PORTSDIR}/textproc/flex \
 		help2man:${PORTSDIR}/misc/help2man

 CONFLICTS=	grub-0*
+SSP_UNSAFE=	yes
 USE_XZ=		yes
 USE_GCC=	yes
 USE_AUTOTOOLS=	automake aclocal autoconf
--- a/sysutils/mono-kmod/Makefile
+++ b/sysutils/mono-kmod/Makefile
@ -1,9 +1,5 @@
-# Ports collection makefile for: mono-kmod
-# Date created:		14 April 2007
-# Whom:			bkoenig@cs.tu-berlin.de
-#
+# Created by: bkoenig@cs.tu-berlin.de
 # $FreeBSD$
-#

 PORTNAME=	mono-kmod
 PORTVERSION=	20070416
@ -15,6 +11,7 @@ COMMENT=	Execute .NET applications from command line

 ONLY_FOR_ARCHS=	i386 amd64 arm

+SSP_UNSAFE=	kernel module does not support ssp
 USE_BZIP2=	yes
 KMODDIR?=	/boot/modules
 SUB_FILES=	pkg-message
--- a/sysutils/pefs-kmod/Makefile
+++ b/sysutils/pefs-kmod/Makefile
@ -1,4 +1,4 @@
-# Created by: Gleb Kurtsou <gleb@freebsd.org>
+# Created by: Gleb Kurtsou <gleb@FreeBSD.org>
 # $FreeBSD$

 PORTNAME=	pefs
@ -12,6 +12,7 @@ COMMENT=	PEFS kernel level stacked cryptographic filesystem

 LICENSE=	BSD

+SSP_UNSAFE=	kernel module does not support ssp
 FETCH_ARGS=	-Fpr		# work around 302 redirect

 KMODDIR?=	/boot/modules
--- a/sysutils/pmap/Makefile
+++ b/sysutils/pmap/Makefile
@ -11,6 +11,7 @@ MASTER_SITES=	${MASTER_SITE_LOCAL:S!$!skv/!} \
 MAINTAINER=	ports@FreeBSD.org
 COMMENT=	Detailed process memory display

+SSP_UNSAFE=	kernel module does not support ssp
 NO_PACKAGE=	Depends on kernel

 KMODDIR=	/boot/modules
--- a/sysutils/scprotect/Makefile
+++ b/sysutils/scprotect/Makefile
@ -1,9 +1,5 @@
-# New ports collection Makefile for:	scprotect
-# Date created:		5 Feb 2009
-# Whom:			Denis Barov  <dindin@dindin.ru>
-#
+# Created by: Denis Barov  <dindin@dindin.ru>
 # $FreeBSD$
-#

 PORTNAME=	scprotect
 PORTVERSION=	20091116
@ -14,6 +10,7 @@ MAINTAINER=	ports@FreeBSD.org
 COMMENT=	Protect process from killing when the swap space is exhausted

 NO_PACKAGE=	Needs to be compiled for specific kernel
+SSP_UNSAFE=	kernel module does not support ssp

 KMODDIR?=	/boot/modules

--- a/sysutils/vordog/Makefile
+++ b/sysutils/vordog/Makefile
@ -1,9 +1,5 @@
-# Ports collection makefile for: vordog
-# Date created: 8 July 2008
-# Whom:		Kueifeng Li <thinker@branda.to>
-#
+# Created by: Kueifeng Li <thinker@branda.to>
 # $FreeBSD$
-#

 PORTNAME=	vordog
 PORTVERSION=	20080708
@ -13,6 +9,7 @@ MASTER_SITES=	http://www.assembla.com/spaces/vordog/documents/dcR7vqtqyr3AMlab7j
 MAINTAINER=	ports@FreeBSD.org
 COMMENT=	Watchdog(9) driver for watchdog timer of Vortex86

+SSP_UNSAFE=	kernel module does not support ssp
 KMODDIR=	/boot/modules

 ONLY_FOR_ARCHS=	i386
--- a/x11/nvidia-driver/Makefile
+++ b/x11/nvidia-driver/Makefile
@ -27,6 +27,7 @@ LICENSE_NAME=	License For Customer Use of NVIDIA Software
 LICENSE_FILE=	${WRKSRC}/doc/license.txt
 LICENSE_PERMS=	dist-mirror no-dist-sell pkg-mirror no-pkg-sell auto-accept

+SSP_UNSAFE=	kernel module does not support ssp
 ARCH_SUFX=	${ARCH:S/i386//:S/amd/_/}
 USE_XORG=	xorg-server
 USE_GL=		gl