Gentoo Archives: gentoo-hardened

From: Mike Edenfield <kutulu@××××××.org>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] Remove the pic use flag in the hardened amd64 profile.
Date: Sun, 27 Feb 2011 19:00:37
Message-Id: 1298832591.31598.16.camel@platypus
In Reply to: Re: [gentoo-hardened] Remove the pic use flag in the hardened amd64 profile. by Ed W
1 On Sun, 2011-02-27 at 16:33 +0000, Ed W wrote:
2
3 > I think what you are saying is that using PIC requires some special
4 > handling (but that work seems largely done now?). However, does
5 > removing PIC leave the AMD64 architecture "less secure" in some way? Or
6 > is some other procedure now replacing PIC?
7
8 You can't "remove PIC" from AMD64 -- it's required for shared library
9 use. But it's also built in to the AMD64 ABI, unlike x86 where it was
10 shoehorned into the existing ABI (by hijacking a register for the GOT).
11 So the USE flag doesn't actually serve any purpose.
12
13 Even worse, some packages disable parts of their code written in
14 assembler when USE=pic (since it fails when the extra register is taken
15 away), but would be fine under AMD64 with tons of extra registers.
16
17 Basically, the pic USE flag is only really useful, needed, or productive
18 on x86, so they're taking it out of the amd64 profile.