Re: [gentoo-hardened] Re: hardened-gcc-3.3.2.1

[Alexander Gabert]

Hi Peter,

> > # conservative PIE PIC and SSP options, on by default, suppress flags
> > take precedence
> > HGCC_33_DEFAULT_SPECS_CPP_SECTION_PIC_ACTIVATION="%{!yet_exec: %{!nopie:
> > -D__PIC__ -D__pic__ -DPIC}}"
> omitted -Dpic (although I haven't found any app needing it).
-Dpic is bad because apache2 for example uses a pointer for ip
addresses, called "pic", when you define pic, this will bail out with a
very very odd error message.
thanks go fully to solar for making this shortcut and slapping my weak
head for this mistake.

> > HGCC_33_DEFAULT_SPECS_CC1_SECTION_PIC_ACTIVATION="%{!yet_exec: %{!nopie:
> > -fPIC -fpie}}"
> Why have you added -fpie?
because i thought it is the gcc accomodating flag to ld -pie
> this has the problems with libraries as described earlier (try
> zlib-1.2.1.ebuild, comment the pic patch and build the shared lib, check
> with readelf -d for TEXTREL. I have to remove -fpie from it, also if it
hmmm, very odd, i dont think its the -fpie, but we need to look at it in
detail
> somehow could work, I think it should be
> %{!yet_exec: %{!nopie: -fPIC %{!static|!shared: -fpie}}} (the static part
thanks, i will think about it and test it here, maybe pipacs can help us
here too.
> is solved probably with %{!static: %{pie:-pie}} at the end of the
> specfile, but for shared libs I do not think -fpie is good.
well, we need to find out what -fpie does
>
> > HGCC_33_DEFAULT_SPECS_CC1_SECTION_SSP_ACTIVATION="%{!yno_propolice:
> > %{!fno-stack-protector: -fstack-protector %{!fno-stack-protector-all:
> > -fstack-protector-all -fforce-addr}}}"
>
> I like this one better, have you checked that fforce is only needed by
> -all?
no, fforce-addr is needed by newer gcc's with high optimizations.
afaik we can take it out for sure
on the other hand, it does not hurt any building other than assembler
hardcore where we already filter on hardened-gcc, speak kernel and boot
loaders...
i think the real line would be
HGCC_33_DEFAULT_SPECS_CC1_SECTION_SSP_ACTIVATION="%{!yno_propolice:
%{!fno-stack-protector: -fforce-addr -fstack-protector
%{!fno-stack-protector-all: -fstack-protector-all}}}"

> # the Scrt1.o provided by Redhat has relocation errors when -pie builds
> > executables with -shared and no main function
> > HGCC_33_DEFAULT_SPECS_STRTSECTION_CRT_ACTIVATION="crt1S.o"
>
> I'll stay with my Scrt1.o for uClibc then (I do not have another one ;-)
yeah, i talked about this also earlier
you could do the -fpie exclude for crt1.o and Scrt1.o also:
18:37:11 <pappy-> while this is not the -shared -pie problem that the
Scrt1.o has unresolved relocation error against nonexisting 
          main()
18:37:24 <pappy-> i think we could filter -shared
18:37:26 <pappy-> and filter -static
18:37:31 <pappy-> and either use crt1S.o from pipacs or the natural
crt1.o from glibc for them

so the line would look like: %{!static: %{!shared: Scrt1.o}} otherwise
the respective %{!static|shared: crt1.o} line applies, i will introduce
this into a later version of hardened-gcc i think.
>
> > # final static linking executables breaks when -pie is given
> > HGCC_33_DEFAULT_SPECS_LINKSECTION_PIE_ACTIVATION="%{!yet_exec: %{!nopie:
> > %{!static: -pie -z combreloc}}}"
> this is the same as earlier and provides one of the doubles.
yeah, i saw it now, i will remove the static from the config entry too,
thanks again
>
> >
> > can you please try these lines in hcc.conf and activate them?
> >
> > TIA,
> >
> > Alex
> >
> > On Mon, 2003-12-15 at 15:06, Peter S. Mazinger wrote:
> > > On Mon, 15 Dec 2003, Peter S. Mazinger wrote:
> > >
> > > New problem: I have rebuilt rpm-4.0.4 and got text relocation in
> > > librpmbuild shared library hardened-gcc-3.3.2.0 worked)
> > > I think we have to enforce -fPIC for all (also for static, because if
> > > later a binary is built against static and dynamic libraries, it will have
> > > problems (like bash's included readline, this is static)
> > > The problem happens with libraries due to the change in cc1 section from
> > > -fPIC to -fPIC -fpie (simple test: build zlib w/o the pic patch)
> > >
> > > > Hello!
> > > >
> > > > The link section has a !static redundancy (from EXC_FRONT and
> > > > PIE_ACTIVATION), see attached diff (edited manually based on hcc.conf and
> > > > the scripts)
> > > >
> > > > Why is crt1S.o added in the default config, the conservative one adds
> > > > Scrt1.o? (crt1S.S is the same as in hardened 2.4.6 non_csu version), it is
> > > > rather a glibc issue having it or not.
> > > >
> > > > Also I am not so sure about the stack-protector[-all] running together, I
> > > > have the impression, that they work separately, but for all cases I would
> > > > suggest the possibility to use only fstack-protector if -all is
> > > > deactivated (there could be some apps that cannot be built with -all) like
> > > > this, or similar
> > > > %{!yno_propolice: %{!fno-stack-protector: -fstack-protector}
> > > > %{!fno-stack-protector-all: -fstack-protector-all}}.
> > > >
> > > > I do not really know which one needs fforce-addr (the kernel works with
> > > > both, using my patch -earlier mail, but does not like fforce-addr).
> > > > So adapt accordingly.
> > > >
> > > > Peter
> > > >
> > > >
> >
-- 
Alexander Gabert <pappy@g.o>
http://www.gentoo.org/proj/en/hardened


--
gentoo-hardened@g.o mailing list