| 1 |
-----Original Message----- |
| 2 |
From: Simon Stelling [mailto:blubb@g.o] |
| 3 |
Sent: Friday, October 21, 2005 1:25 AM |
| 4 |
To: gentoo-amd64@l.g.o |
| 5 |
Subject: Re: [gentoo-amd64] Requesting advice on PIC and amd64 |
| 6 |
|
| 7 |
Hi, |
| 8 |
|
| 9 |
Bob Young wrote: |
| 10 |
> I'm re-installing Gentoo64 yet-again on my dual Opteron box, this time I |
| 11 |
> want to build with nptl and nptlonly use flags starting from stage1. ( |
| 12 |
> <- I'd welcome thoughts/opinions on this as well). |
| 13 |
|
| 14 |
Don't use stage1, it's just a waste of time, IMHO. I usually use the latest |
| 15 |
stage3 (sometimes +GRP) set the use flags i want and do emerge --newuse -D |
| 16 |
system ; emerge --newuse -D world, which does about the same thing. |
| 17 |
Hmm...interesting. I know that CHOST is the same for all of AMD64 so |
| 18 |
changing that isn't an issue, but what about CFLAGS, with this method can I |
| 19 |
specify march=k8 and change other flags (-pipe -O? etc) before the emerge |
| 20 |
system and emerge world without breaking anything? |
| 21 |
|
| 22 |
> In deciding on what other use flags I want, I noticed the pic flag, with |
| 23 |
> it's accompanying warning of "Do not utilize this flag unless you know |
| 24 |
> what you're doing." So I figured I'd better do some research. I've read |
| 25 |
> http://www.gentoo.org/proj/en/hardened/pic-guide.xml and |
| 26 |
> http://www.gentoo.org/proj/en/hardened/pic-internals.xml. It seems that |
| 27 |
> using PIC is primarily a security feature/enhancement. The box is a |
| 28 |
> workstation, and has no public IP address, I'm more interested in |
| 29 |
|
| 30 |
It is, but on AMD64, you have to enable PIC for shared objects, otherwise |
| 31 |
you |
| 32 |
can't link them. Btw, just because your box doesn't have a public IP address |
| 33 |
that doesn't mean it's harder to hijack it :P |
| 34 |
|
| 35 |
> performance than security, but if the PIC adds significant security |
| 36 |
> without noticeably impacting performance on amd64, I'm wondering if |
| 37 |
> adding the pic use flag in make.conf might be a good idea. |
| 38 |
|
| 39 |
You don't need it, but it won't harm either, since it doesn't do anything on |
| 40 |
amd64. |
| 41 |
Adding -fPIC to your CFLAGS will enable PIC on executables too, which will |
| 42 |
make |
| 43 |
them slower and will break some nasty configure scripts too, so hands off |
| 44 |
that |
| 45 |
bad thing ;) |
| 46 |
Okay, thanks for the clarification, I was under the mistaken impression that |
| 47 |
setting the pic use flag would "translate" to -fPIC for the compiler. |
| 48 |
Thanks, |
| 49 |
Bob Young |
| 50 |
San Jose CA. |
| 51 |
|
| 52 |
|
| 53 |
-- |
| 54 |
gentoo-amd64@g.o mailing list |
Archives