Re: [gentoo-amd64] Requesting advice on PIC and amd64

[Simon Stelling]

Hi,

Bob Young wrote:
> I’m re-installing Gentoo64 yet-again on my dual Opteron box, this time I
> want to build with nptl and nptlonly use flags starting from stage1. (
> <- I’d welcome thoughts/opinions on this as well).

Don't use stage1, it's just a waste of time, IMHO. I usually use the latest 
stage3 (sometimes +GRP) set the use flags i want and do emerge --newuse -D 
system ; emerge --newuse -D world, which does about the same thing.

> In deciding on what other use flags I want, I noticed the pic flag, with
> it’s accompanying warning of “Do not utilize this flag unless you know
> what you're doing.” So I figured I’d better do some research. I’ve read
> http://www.gentoo.org/proj/en/hardened/pic-guide.xml and
> http://www.gentoo.org/proj/en/hardened/pic-internals.xml. It seems that
> using PIC is primarily a security feature/enhancement. The box is a
> workstation, and has no public IP address, I’m more interested in

It is, but on AMD64, you have to enable PIC for shared objects, otherwise you 
can't link them. Btw, just because your box doesn't have a public IP address 
that doesn't mean it's harder to hijack it :P

> performance than security, but if the PIC adds significant security
> without noticeably impacting performance on amd64, I’m wondering if
> adding the pic use flag in make.conf might be a good idea.

You don't need it, but it won't harm either, since it doesn't do anything on amd64.
Adding -fPIC to your CFLAGS will enable PIC on executables too, which will make 
them slower and will break some nasty configure scripts too, so hands off that 
bad thing ;)

Regards,

-- 
Simon Stelling
Gentoo/AMD64 Operational Co-Lead
blubb@g.o
-- 
gentoo-amd64@g.o mailing list