[gentoo-hardened] Re: hardened-gcc-3.3.2.1

[Alexander Gabert]

hi Peter, thanks for your bug reports,

# conservative PIE PIC and SSP options, on by default, suppress flags
take precedence
HGCC_33_DEFAULT_SPECS_CPP_SECTION_PIC_ACTIVATION="%{!yet_exec: %{!nopie:
-D__PIC__ -D__pic__ -DPIC}}"
HGCC_33_DEFAULT_SPECS_CC1_SECTION_PIC_ACTIVATION="%{!yet_exec: %{!nopie:
-fPIC -fpie}}"
HGCC_33_DEFAULT_SPECS_CC1_SECTION_SSP_ACTIVATION="%{!yno_propolice:
%{!fno-stack-protector: -fstack-protector %{!fno-stack-protector-all:
-fstack-protector-all -fforce-addr}}}"
# the Scrt1.o provided by Redhat has relocation errors when -pie builds
executables with -shared and no main function
HGCC_33_DEFAULT_SPECS_STRTSECTION_CRT_ACTIVATION="crt1S.o" 
# final static linking executables breaks when -pie is given
HGCC_33_DEFAULT_SPECS_LINKSECTION_PIE_ACTIVATION="%{!yet_exec: %{!nopie:
%{!static: -pie -z combreloc}}}"

can you please try these lines in hcc.conf and activate them?

TIA,

Alex

On Mon, 2003-12-15 at 15:06, Peter S. Mazinger wrote:
> On Mon, 15 Dec 2003, Peter S. Mazinger wrote:
>
> New problem: I have rebuilt rpm-4.0.4 and got text relocation in
> librpmbuild shared library hardened-gcc-3.3.2.0 worked)
> I think we have to enforce -fPIC for all (also for static, because if
> later a binary is built against static and dynamic libraries, it will have
> problems (like bash's included readline, this is static)
> The problem happens with libraries due to the change in cc1 section from
> -fPIC to -fPIC -fpie (simple test: build zlib w/o the pic patch)
>
> > Hello!
> >
> > The link section has a !static redundancy (from EXC_FRONT and
> > PIE_ACTIVATION), see attached diff (edited manually based on hcc.conf and
> > the scripts)
> >
> > Why is crt1S.o added in the default config, the conservative one adds
> > Scrt1.o? (crt1S.S is the same as in hardened 2.4.6 non_csu version), it is
> > rather a glibc issue having it or not.
> >
> > Also I am not so sure about the stack-protector[-all] running together, I
> > have the impression, that they work separately, but for all cases I would
> > suggest the possibility to use only fstack-protector if -all is
> > deactivated (there could be some apps that cannot be built with -all) like
> > this, or similar
> > %{!yno_propolice: %{!fno-stack-protector: -fstack-protector}
> > %{!fno-stack-protector-all: -fstack-protector-all}}.
> >
> > I do not really know which one needs fforce-addr (the kernel works with
> > both, using my patch -earlier mail, but does not like fforce-addr).
> > So adapt accordingly.
> >
> > Peter
> >
> >
-- 
Alexander Gabert <pappy@g.o>
http://www.gentoo.org/proj/en/hardened


--
gentoo-hardened@g.o mailing list