[gentoo-hardened] Re: hardened-gcc-3.3.2.1

[Peter S. Mazinger]

On Mon, 15 Dec 2003, Alexander Gabert wrote:

> hi Peter, thanks for your bug reports,
>
> # conservative PIE PIC and SSP options, on by default, suppress flags
> take precedence
> HGCC_33_DEFAULT_SPECS_CPP_SECTION_PIC_ACTIVATION="%{!yet_exec: %{!nopie:
> -D__PIC__ -D__pic__ -DPIC}}"
omitted -Dpic (although I haven't found any app needing it).

> HGCC_33_DEFAULT_SPECS_CC1_SECTION_PIC_ACTIVATION="%{!yet_exec: %{!nopie:
> -fPIC -fpie}}"
Why have you added -fpie?

this has the problems with libraries as described earlier (try 
zlib-1.2.1.ebuild, comment the pic patch and build the shared lib, check 
with readelf -d for TEXTREL. I have to remove -fpie from it, also if it 
somehow could work, I think it should be
%{!yet_exec: %{!nopie: -fPIC %{!static|!shared: -fpie}}} (the static part 
is solved probably with %{!static: %{pie:-pie}} at the end of the 
specfile, but for shared libs I do not think -fpie is good.

> HGCC_33_DEFAULT_SPECS_CC1_SECTION_SSP_ACTIVATION="%{!yno_propolice:
> %{!fno-stack-protector: -fstack-protector %{!fno-stack-protector-all:
> -fstack-protector-all -fforce-addr}}}"

I like this one better, have you checked that fforce is only needed by 
-all?

> # the Scrt1.o provided by Redhat has relocation errors when -pie builds
> executables with -shared and no main function
> HGCC_33_DEFAULT_SPECS_STRTSECTION_CRT_ACTIVATION="crt1S.o"

I'll stay with my Scrt1.o for uClibc then (I do not have another one ;-)

> # final static linking executables breaks when -pie is given
> HGCC_33_DEFAULT_SPECS_LINKSECTION_PIE_ACTIVATION="%{!yet_exec: %{!nopie:
> %{!static: -pie -z combreloc}}}"
this is the same as earlier and provides one of the doubles.

>
> can you please try these lines in hcc.conf and activate them?
>
> TIA,
>
> Alex
>
> On Mon, 2003-12-15 at 15:06, Peter S. Mazinger wrote:
> > On Mon, 15 Dec 2003, Peter S. Mazinger wrote:
> >
> > New problem: I have rebuilt rpm-4.0.4 and got text relocation in
> > librpmbuild shared library hardened-gcc-3.3.2.0 worked)
> > I think we have to enforce -fPIC for all (also for static, because if
> > later a binary is built against static and dynamic libraries, it will have
> > problems (like bash's included readline, this is static)
> > The problem happens with libraries due to the change in cc1 section from
> > -fPIC to -fPIC -fpie (simple test: build zlib w/o the pic patch)
> >
> > > Hello!
> > >
> > > The link section has a !static redundancy (from EXC_FRONT and
> > > PIE_ACTIVATION), see attached diff (edited manually based on hcc.conf and
> > > the scripts)
> > >
> > > Why is crt1S.o added in the default config, the conservative one adds
> > > Scrt1.o? (crt1S.S is the same as in hardened 2.4.6 non_csu version), it is
> > > rather a glibc issue having it or not.
> > >
> > > Also I am not so sure about the stack-protector[-all] running together, I
> > > have the impression, that they work separately, but for all cases I would
> > > suggest the possibility to use only fstack-protector if -all is
> > > deactivated (there could be some apps that cannot be built with -all) like
> > > this, or similar
> > > %{!yno_propolice: %{!fno-stack-protector: -fstack-protector}
> > > %{!fno-stack-protector-all: -fstack-protector-all}}.
> > >
> > > I do not really know which one needs fforce-addr (the kernel works with
> > > both, using my patch -earlier mail, but does not like fforce-addr).
> > > So adapt accordingly.
> > >
> > > Peter
> > >
> > >
>

-- 
Peter S. Mazinger <ps.m@×××.net>   ID: 0xA5F059F2    NIC: IXUYHSKQLI
Key fingerprint = 92A4 31E1 56BC 3D5A 2D08  BB6E C389 975E A5F0 59F2


____________________________________________________________________
Miert fizetsz az internetert? Korlatlan, ingyenes internet hozzaferes a FreeStarttol.
Probald ki most! http://www.freestart.hu

--
gentoo-hardened@g.o mailing list