Gentoo Archives: gentoo-hardened

From: Mike Edenfield <kutulu@××××××.org>
To: gentoo-hardened@l.g.o
Cc: "Anthony G. Basile" <blueness@g.o>
Subject: Re: [gentoo-hardened] Re: Remove the pic use flag in the hardened amd64 profile.
Date: Wed, 02 Mar 2011 15:18:40
Message-Id: 4D6E5F42.6030200@kutulu.org
In Reply to: Re: [gentoo-hardened] Re: Remove the pic use flag in the hardened amd64 profile. by "Anthony G. Basile"
1 On 3/1/2011 6:22 PM, Anthony G. Basile wrote:
2 > On 03/01/2011 03:02 PM, pageexec@××××××××.hu wrote:
3 >> On 28 Feb 2011 at 15:39, Daniel Reidy wrote:
4 >>
5 >>> On Sun, Feb 27, 2011 at 5:58 PM, <pageexec@××××××××.hu> wrote:
6 >>>> that's actually not the intended use of the PIC USE flag, we wanted it originally
7 >>>> to enable configuring/compiling position independent code for packages where one
8 >>>> wanted to make a tradeoff between speed/security (i think php was one such app,
9 >>>> even without any hand written asm code).
10 >>>>
11 >>>> so with USE=pic you were supposed to get a textrel free, but potentially slower
12 >>>> binary (partly because of the PIC overhead on i386 and partly because sometimes
13 >>>> it meant using the C implementation of some algo instead of hand written asm).
14 >>>
15 >>> So if I understand this correctly, we should now be turning off PIC on
16 >>> Gentoo-Hardened systems running on AMD64. What about the non-hardened
17 >>> variety, such as my desktop, that is only running a "stock" version of
18 >>> Gentoo Sources without hardened features?
19 >>
20 >> USE=pic should have exactly 0 effect on amd64 because the arch and the ELF ABI
21 >> makes PIC zero cost basically. if some package manages to get around the rules
22 >> somehow, it's a bug in that package, treat it accordingly ;).
23 >>
24 >
25 > This was Zorry's point. So if it has no effect, why keep it? I say
26 > let's remove it.
27
28 There is no point in keeping it. This discussion has mostly been about
29 reassuring people with less intimate knowledge of the AMD64 ABI of that
30 fact :)