Re: [gentoo-hardened] sweet flag-o-matic lubbin'

[Scott W Taylor]

I'd like to know if all the excessive flags that are checked for now
(with the various capitalizations and such) are still really in use, or
were ever in use, or will in the future be used. If not, then maybe some
of this is redundant and we could trim it back to mor like what we'd
come up with earlier in the night. 

Goals for this patch were something that (1) worked with currently known
versions of gcc/hgcc/pappy-gcc (2) readable, and making these tests
available to ebuilds in a nice clean *consistent* way, that is easily
extensible to handle whichever way such pic/ssp features are triggered
in the future, or set environment variables or any other appropriate
method (3) test validity of the -yet_exec and such calls before adding
them, otherwise filter-flags -fPIC will at least print error messages if
a stock gcc user adding CFLAGS="-fPIC" (4) strip the -fPIC, etc. flags
whenever the matching filter-flags call is made. Sure, -yet_exec
overrides this, and it still gets added when gcc knows what it is, but
as these things are more likely now to show up in CFLAGS with or without
hardened-gcc being there, we thought this was an appropriate thing to
strip. 


--- /opt/gentoo-rsync/untouched/eclass/flag-o-matic.eclass	2004-03-16 14:41:32.000000000 -0700
+++ flag-o-matic.eclass	2004-04-02 22:58:56.374385350 -0700
@@ -265,6 +265,30 @@
 	return 1
 }
 
+has_pic() {
+	[ "${CFLAGS/-fPIC}" != "${CFLAGS}" ] && return 0
+	[ "${CFLAGS/-fpic}" != "${CFLAGS}" ] && return 0
+	[ has_version sys-devel/hardened-gcc ] && return 0
+	[ ! -z "`${CC/ .*/} --version| grep pie`" ] && return 0
+	return 1
+}
+
+has_pie() { 
+	[ "${CFLAGS/-fPIE}" != "${CFLAGS}" ] && return 0
+	[ "${CFLAGS/-fpie}" != "${CFLAGS}" ] && return 0
+	[ "${CFLAGS/-pie}" != "${CFLAGS}" ] && return 0
+	[ has_version sys-devel/hardened-gcc ] && return 0
+	[ ! -z "`${CC/ .*/} --version| grep pie`" ] && return 0
+	return 1
+}
+
+has_ssp() {
+	[ "${CFLAGS/-fstack-protector}" != "${CFLAGS}" ] && return 0
+	[ has_version sys-devel/hardened-gcc ] && return 0
+	[ ! -z "`${CC/ .*/} --version| grep pie`" ] && return 0
+	return 1
+}
+
 replace-sparc64-flags() {
 	local SPARC64_CPUS="ultrasparc v9"
 
@@ -312,23 +336,29 @@
 }
 
 etexec-flags() {
-	has_version sys-devel/hardened-gcc
+	has_pie || has_pic
 	if [ $? == 0 ] ; then
+		# strip -fPIC/fPIE flags regardless if you've gotten this far
+		strip-flags -fPIC -fpic -fPIE -fpie -pie
 		if [ "`is-flag -yet_exec`" != "true" ]; then
-			debug-print ">>> appending flags -yet_exec"
-			append-flags -yet_exec
-			append-ldflags -yet_exec
+			# If our compiler supports -yet_exec, append it now
+			[ -z "`gcc -yet_exec -S -o /dev/null -xc /dev/null 2>&1`" ] \
+				&& ( debug-print ">>> appending flags -yet_exec" ; \
+					append-flags -yet_exec ; append-ldflags -yet_exec )
 		fi
 	fi
 }
 
 fstack-flags() {
-	has_version sys-devel/hardened-gcc
+	has_ssp
 	if [ $? == 0 ] ; then
+		# strip -fstack-protector regardless if you've gotten this far
+		strip-flags -fstack-protector -fstack-protector-all
 		if [ "`is-flag -yno_propolice`" != "true" ]; then
-			debug-print ">>> appending flags -yno_propolice"
-			append-flags -yno_propolice
-			append-ldflags -yno_propolice
+			# If our compiler supports -yno_propolice, append it now
+			[ -z "`gcc -yno_propolice -S -o /dev/null -xc /dev/null 2>&1`" ] \
+				&& ( debug-print ">>> appending flags -yno_propolice" ; \
+					append-flags -yno_propolice ; append-ldflags -yno_propolice )
 		fi
 	fi
 }

On Fri, 2004-04-02 at 22:52, Brandon Hale wrote:
> After I posted this we continued to do heavy development, there are more
> cases to work out (-yet_exec -yno_propolice are not supported by a stock
> Gentoo GCC using ssp/pie in CFLAGS). Feel free to join in our discussion
> or pitch in, otherwise we'll keep hacking on this..


-- 
Scott W Taylor <swtaylor@g.o>


--
gentoo-hardened@g.o mailing list