Automated STIG Implementation for PX4 Autopilot

render-se / PX4-Autopilot

PX4 Autopilot Software

https://px4.io

BSD 3-Clause "New" or "Revised" License

0 stars 0 forks source link

Automated STIG Implementation for PX4 Autopilot #5

Open bpmooch opened 2 years ago

bpmooch commented 2 years ago

This ticket captures the implementation details requirements coming out the delivered Flight Controller STIG

Internal spreadsheet view of PX4 STIG

PX4 STIG Deliverable spreadsheet

PX4-Autopilot Acceptance Criteria

[x] Manually copy the px4_sitl make target to determine differences between sitl and fmu-v5
[x] #7
[x] #9
[ ] #10
[ ] Create px4_fmu-v5-constrained_test make target for running tests against stig compliant firmware build
[ ] Run thread sanitizer on every test build (reference issue)
[ ] Remove any XML code from firmware builds. First pass showed only xmlrpc lib which can be removed from nuttx-apps repo (reference issue)
[ ] Remove nuttshell from PX4 build. It's possible nuttshell can't be fully disabled due to heavy usage in PX4-Autopilot (reference issue)

"Turbotax" Acceptance Criteria

[ ] We need to determine what "error handling vulnerabilities" are in a defensible way (reference issue)
[ ] Generate software bill of materials (reference link)

jrn90 commented 2 years ago

Fun find: Changing the CMAKE_BUILD_TYPE to anything but Release will break the px4_fmu-v5 target from compiling (typically with a stack overflow Wframe-larger-than error). This is because the Release target by default injects two compiler flags for gcc: -Os and -DNDEBUG.

-Os sets gcc's Optimize Options to optimize for size. Ref
-DNDEBUG disables all assert() functions. Ref and Ref

Appending these two compiler flags onto the px4_fmu-v5 target solves the issue of not being able to compile.