| Message ID | 87h8anr9jo.fsf@oldenburg2.str.redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | Extend BIND_NOW to installed programs with --enable-bind-now | expand |
It turns out that static PIE programs benefit from -z now as well (more
RELRO coverage), so the patch below is a small improvement over the
first patch.
Thanks,
Florian
Extend BIND_NOW to installed programs with --enable-bind-now
Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix
--enable-bind-now [BZ #21015]") extended BIND_NOW to all installed
shared objects. This change also covers installed programs.
2019-04-24 Florian Weimer <fweimer@redhat.com>
Also enable BIND_NOW for programs if --enable-bind-now.
* Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now.
(+link-pie): Use $(link-extra-flags).
(+link-static): Likewise.
[! $(build-pie-default)] (+link): Likewise.
* manual/install.texi (Configuring and compiling): Update
--enable-bind-now description.
* INSTALL: Regenerated.
diff --git a/INSTALL b/INSTALL
index ddb9e9018d..e137a71169 100644
--- a/INSTALL
+++ b/INSTALL
@@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization. For example:
protection.
'--enable-bind-now'
- Disable lazy binding for installed shared objects. This provides
- additional security hardening because it enables full RELRO and a
- read-only global offset table (GOT), at the cost of slightly
- increased program load times.
+ Disable lazy binding for installed shared objects and programs.
+ This provides additional security hardening because it enables full
+ RELRO and a read-only global offset table (GOT), at the cost of
+ slightly increased program load times.
'--enable-pt_chown'
The file 'pt_chown' is a helper binary for 'grantpt' (*note
diff --git a/Makeconfig b/Makeconfig
index 07007c9459..89443e9a90 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -398,6 +398,8 @@ endif
# test modules.
ifeq ($(bind-now),yes)
LDFLAGS-lib.so += -Wl,-z,now
+# Extra flags for dynamically linked non-test main programs.
+link-extra-flags += -Wl,-z,now
endif
# Command to run after every final link (executable or shared object).
@@ -426,7 +428,7 @@ ifndef +link-pie
$(link-extra-libs)
+link-pie-after-libc = $(+postctorS) $(+postinit)
define +link-pie
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
$(call after-link,$@)
endef
define +link-pie-tests
@@ -454,7 +456,7 @@ ifndef +link-static
$(link-extra-libs-static)
+link-static-after-libc = $(+postctorT) $(+postinit)
define +link-static
-$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)
+$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
$(call after-link,$@)
endef
define +link-static-tests
@@ -485,7 +487,7 @@ else # not build-pie-default
$(link-extra-libs)
+link-after-libc = $(+postctor) $(+postinit)
define +link
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
+$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
$(call after-link,$@)
endef
define +link-tests
diff --git a/NEWS b/NEWS
index 63581b3618..792ffb1ec8 100644
--- a/NEWS
+++ b/NEWS
@@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility:
* The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub
resolver have been removed from <resolv.h>.
+* With --enable-bind-now, installed programs are now linked with the
+ BIND_NOW flag.
+
Changes to build and runtime requirements:
* GCC 6.2 or later is required to build the GNU C Library.
diff --git a/manual/install.texi b/manual/install.texi
index a9b8b4974c..29f6b68e25 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this
protection.
@item --enable-bind-now
-Disable lazy binding for installed shared objects. This provides
-additional security hardening because it enables full RELRO and a
-read-only global offset table (GOT), at the cost of slightly increased
-program load times.
+Disable lazy binding for installed shared objects and programs. This
+provides additional security hardening because it enables full RELRO
+and a read-only global offset table (GOT), at the cost of slightly
+increased program load times.
@pindex pt_chown
@findex grantpt
On 4/24/19 9:57 AM, Florian Weimer wrote: > It turns out that static PIE programs benefit from -z now as well (more > RELRO coverage), so the patch below is a small improvement over the > first patch. LGTM. Reviewed-by: Carlos O'Donell <carlos@redhat.com> > Extend BIND_NOW to installed programs with --enable-bind-now > > Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix > --enable-bind-now [BZ #21015]") extended BIND_NOW to all installed > shared objects. This change also covers installed programs. > > 2019-04-24 Florian Weimer <fweimer@redhat.com> > > Also enable BIND_NOW for programs if --enable-bind-now. > * Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now. > (+link-pie): Use $(link-extra-flags). > (+link-static): Likewise. OK. > [! $(build-pie-default)] (+link): Likewise. > * manual/install.texi (Configuring and compiling): Update > --enable-bind-now description. > * INSTALL: Regenerated. > > diff --git a/INSTALL b/INSTALL > index ddb9e9018d..e137a71169 100644 > --- a/INSTALL > +++ b/INSTALL > @@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization. For example: > protection. > > '--enable-bind-now' > - Disable lazy binding for installed shared objects. This provides > - additional security hardening because it enables full RELRO and a > - read-only global offset table (GOT), at the cost of slightly > - increased program load times. > + Disable lazy binding for installed shared objects and programs. > + This provides additional security hardening because it enables full > + RELRO and a read-only global offset table (GOT), at the cost of > + slightly increased program load times. > > '--enable-pt_chown' > The file 'pt_chown' is a helper binary for 'grantpt' (*note > diff --git a/Makeconfig b/Makeconfig > index 07007c9459..89443e9a90 100644 > --- a/Makeconfig > +++ b/Makeconfig > @@ -398,6 +398,8 @@ endif > # test modules. > ifeq ($(bind-now),yes) > LDFLAGS-lib.so += -Wl,-z,now > +# Extra flags for dynamically linked non-test main programs. > +link-extra-flags += -Wl,-z,now OK. Adds to link-extra-flags used by programs only under $(bind-now) being selected. > endif > > # Command to run after every final link (executable or shared object). > @@ -426,7 +428,7 @@ ifndef +link-pie > $(link-extra-libs) > +link-pie-after-libc = $(+postctorS) $(+postinit) > define +link-pie > -$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc) > +$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc) OK. Add to link command for linking pie programs. > $(call after-link,$@) > endef > define +link-pie-tests > @@ -454,7 +456,7 @@ ifndef +link-static > $(link-extra-libs-static) > +link-static-after-libc = $(+postctorT) $(+postinit) > define +link-static > -$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc) > +$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc) OK. Likewise for static programs. > $(call after-link,$@) > endef > define +link-static-tests > @@ -485,7 +487,7 @@ else # not build-pie-default > $(link-extra-libs) > +link-after-libc = $(+postctor) $(+postinit) > define +link > -$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc) > +$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc) OK. Likewise for normal programs (non-PIE, non-static). > $(call after-link,$@) > endef > define +link-tests > diff --git a/NEWS b/NEWS > index 63581b3618..792ffb1ec8 100644 > --- a/NEWS > +++ b/NEWS > @@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility: > * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub > resolver have been removed from <resolv.h>. > > +* With --enable-bind-now, installed programs are now linked with the > + BIND_NOW flag. OK. Perfect. Thanks for the NEWS entry. > + > Changes to build and runtime requirements: > > * GCC 6.2 or later is required to build the GNU C Library. > diff --git a/manual/install.texi b/manual/install.texi > index a9b8b4974c..29f6b68e25 100644 > --- a/manual/install.texi > +++ b/manual/install.texi > @@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this > protection. > > @item --enable-bind-now > -Disable lazy binding for installed shared objects. This provides > -additional security hardening because it enables full RELRO and a > -read-only global offset table (GOT), at the cost of slightly increased > -program load times. > +Disable lazy binding for installed shared objects and programs. This > +provides additional security hardening because it enables full RELRO > +and a read-only global offset table (GOT), at the cost of slightly > +increased program load times. OK. Looks good. > > @pindex pt_chown > @findex grantpt >
diff --git a/INSTALL b/INSTALL index ddb9e9018d..e137a71169 100644 --- a/INSTALL +++ b/INSTALL @@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization. For example: protection. '--enable-bind-now' - Disable lazy binding for installed shared objects. This provides - additional security hardening because it enables full RELRO and a - read-only global offset table (GOT), at the cost of slightly - increased program load times. + Disable lazy binding for installed shared objects and programs. + This provides additional security hardening because it enables full + RELRO and a read-only global offset table (GOT), at the cost of + slightly increased program load times. '--enable-pt_chown' The file 'pt_chown' is a helper binary for 'grantpt' (*note diff --git a/Makeconfig b/Makeconfig index 07007c9459..768df2c3ef 100644 --- a/Makeconfig +++ b/Makeconfig @@ -398,6 +398,8 @@ endif # test modules. ifeq ($(bind-now),yes) LDFLAGS-lib.so += -Wl,-z,now +# Extra flags for dynamically linked non-test main programs. +link-extra-flags += -Wl,-z,now endif # Command to run after every final link (executable or shared object). @@ -426,7 +428,7 @@ ifndef +link-pie $(link-extra-libs) +link-pie-after-libc = $(+postctorS) $(+postinit) define +link-pie -$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc) +$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc) $(call after-link,$@) endef define +link-pie-tests @@ -485,7 +487,7 @@ else # not build-pie-default $(link-extra-libs) +link-after-libc = $(+postctor) $(+postinit) define +link -$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc) +$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc) $(call after-link,$@) endef define +link-tests diff --git a/NEWS b/NEWS index 63581b3618..792ffb1ec8 100644 --- a/NEWS +++ b/NEWS @@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility: * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub resolver have been removed from <resolv.h>. +* With --enable-bind-now, installed programs are now linked with the + BIND_NOW flag. + Changes to build and runtime requirements: * GCC 6.2 or later is required to build the GNU C Library. diff --git a/manual/install.texi b/manual/install.texi index a9b8b4974c..29f6b68e25 100644 --- a/manual/install.texi +++ b/manual/install.texi @@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this protection. @item --enable-bind-now -Disable lazy binding for installed shared objects. This provides -additional security hardening because it enables full RELRO and a -read-only global offset table (GOT), at the cost of slightly increased -program load times. +Disable lazy binding for installed shared objects and programs. This +provides additional security hardening because it enables full RELRO +and a read-only global offset table (GOT), at the cost of slightly +increased program load times. @pindex pt_chown @findex grantpt
We received guidance that we should also enable BIND_NOW for installed programs. I think we can reuse the --enable-bind-now flag for that. Thanks, Florian --- Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix --enable-bind-now [BZ #21015]") extended BIND_NOW to all installed shared objects. This change also covers installed programs. 2019-04-24 Florian Weimer <fweimer@redhat.com> Also enable BIND_NOW for programs if --enable-bind-now. * Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now. (+link-pie): Use $(link-extra-flags). [! $(build-pie-default)] (+link): Likewise. * manual/install.texi (Configuring and compiling): Update --enable-bind-now description. * INSTALL: Regenerated.