Re: pieworld (was Re: [gentoo-hardened] TESTING kevquinn_overlays: amd64 hardened gcc - (bugzilla is down, i hope the mails are not))

[Peter S. Mazinger]

On Thu, 18 Jan 2007, Kevin F. Quinn wrote:
[...]
> > > The way to build a PIE, as I understand it, is to:
> > >
> > > (1) compile all objects -fPIE
> > > (2) link with -fPIE -pie
> >
> > (2) link with -pie (-fPIE does not/should not influence linking)
>
> I would have thought so, however gcc info says:
>
> `-pie'
>      Produce a position independent executable on targets which support
>      it.  For predictable results, you must also specify the same set
>      of options that were used to generate code (`-fpie', `-fPIE', or
>      model suboptions) when you specify this option.
>
> so I was just following that advice.  I suspect it makes no difference
> on x86, amd64, ppc - but perhaps it does on some platforms.

-fPIE|-fpie is only for compiling, -pie applied to gcc propagates to ld as 
well (and chooses the right crt files.
I cant remember seeing -fPIE propagated to ld, try to provide it to ld and 
it will fail, so gcc filters it out

> I think that when linking, the gcc driver also processes the cc1 spec,
> (where you've added ${pie:-fPIE}) so our default is to add '-fPIE -pie'
> anyway.
I have added -pie compile option for consistency to have gcc -pie do 
proper compiling and linking (piepatch/nondef/*), vanilla gcc will ignore 
-pie for compile and propagates it to ld on linking
[...]
>
> Why would anyone link a lib*.a into a shared library?  Surely you would
> just link to the .so?
because maybe a shared version is not present at all

> stuff, to check the configure fix.  If libstdc++.a is acceptable -fPIE
> then I think we're fine - if you really need it -fPIC, then that
> implies you're linking it into shared libraries which is strange.
true for all libs having also .so counterparts, then it is expectable that 
shared libs (in fact everything non-static) links against .so

Peter

-- 
Peter S. Mazinger <ps dot m at gmx dot net>           ID: 0xA5F059F2
Key fingerprint = 92A4 31E1 56BC 3D5A 2D08  BB6E C389 975E A5F0 59F2

-- 
gentoo-hardened@g.o mailing list