Re: [gentoo-hardened] RELRO and Xorg

[Tóth Attila]

So how it can be verified, that the compiled ELF has RELRO and NOW?
1. RELRO can be verified by calling readelf with the -l option and look
for RELRO. If it's there, the ELF was compiled with RELRO
2. NOW can be verified by calling readelf with the -d option and look for
BIND_NOW
If the ELF has both, it's full RELRO. If it has only RELRO, but no
BIND_NOW, it's lazy.

If I comment out the append flag row in the xorg eclass, the resulting ELF
will be full relro. Without explicitly specifying relro and now. That's
probably because of the hardened toolchain.

I will give a try to the radeon driver soon. Now it's only Xorg and most
of the drivers compiled with full relro, except for the video card driver.
-- 
dr Tóth Attila, Radiológus, 06-20-825-8057
Attila Toth MD, Radiologist, [phone]

2013.Október 1.(K) 22:26 időpontban Hinnerk van Bruinehsen ezt írta:
> On Tue, Oct 01, 2013 at 10:34:07PM +0300, Alex Efros wrote:
>> Hi!
>>
>> On Tue, Oct 01, 2013 at 09:21:00PM +0200, Hinnerk van Bruinehsen wrote:
>> > If you want to try, you could try the xorg-2.eclass from here:
>> >
>> > https://github.com/N8Fear/hvb-overlay/blob/master/eclass/xorg-2.eclass
>> >
>> > either by temporarily overwriting the one from the portage tree or
>> otherwise by
>>
>> Overwriting one from the portage is ok, I think. What next - rebuild
>> x11-base/xorg-server-1.14.3 and restart Xorg to check is it works ok?
>>
>> --
>> 			WBR, Alex.
>
> That should do it - and on the next sync everything should be back to
> normal.
> Btw: seems like building the driver (xf86-video-intel in my case) seems to
> break X (no screens found).
> I think it still would be an improvement nonetheless if xorg-server  could
> be
> build with full relro.
> The question is if it's the same for other drivers (building the drivers
> break
> X, building the server itself with full relro works).
>
> One other more or less losely related thing: x86-input-synaptics works
> with
> full relro for me.
>
>