Re: [gentoo-hardened] TESTING kevquinn_overlays: amd64 hardened gcc - (bugzilla is down, i hope the mails are not)

[Peter S. Mazinger]

On Tue, 12 Dec 2006, Alexander Gabert wrote:

> Kevin: this is the build failures, i would have made them end up adding
> into bugzilla but one of us both wasn't awake.
>
> PSM: if you're reading up: i don't have a clue.
>
> In the meantime, working with bugs.g.o. it's getting a real hassle, so
> can someone please kick that pos in the shins so we can work on bugs
> again?  TIA
>
> I think we should have a talk or two and maybe a test case for building
> that libiberty on all arches with either PIC or PIE code.
> I honestly don't care howe we build it, i just want it to work on all
> Gentoo supported arches for hardened.
>
> For those of you having issues with the file: here is the log for pitr
> and miranda:
>
> http://dev.gentoo.org/~pappy/tmp/amd64-pie-libiberty-failure.txt

It seems some of you are mixing up PIC and PIE. For the record, there are 
no PIE libraries and if you want to run a hardened box where each file is 
text relocation free, then you have to compile all code that goes to 
libraries (even into lib*.a) with -fPIC|-fpic. To quickly check this 
statement, compile some object with -fPIE, put into libx.a and compile a 
shared lib with -fPIC using code from libx.a. readelf -d shared_lib | grep 
TEXTREL.

The pie patches compile everything with -fPIE unless -fPIC was used, the 
app itself has to take care (and most apps using libtool do it by using 
-fPIC -DPIC) that code that goes into libs is -fPIC compiled. libtool 
fails only in cases where configure does not recognize correctly the 
target (thats why gnuconfig_update/libtoolize are needed).

Some will argue, that it does not make sense to compile code in lib*.a 
with -fPIC. Those shouldn't use hardened, because they end up with text 
relocations and a hardened box should block text relocations either in 
kernel (PaX feature) or libc (possible with uClibc, but not glibc)

Peter

-- 
Peter S. Mazinger <ps dot m at gmx dot net>           ID: 0xA5F059F2
Key fingerprint = 92A4 31E1 56BC 3D5A 2D08  BB6E C389 975E A5F0 59F2

-- 
gentoo-hardened@g.o mailing list