| Message ID | 20221209112409.184703-7-pbonzini@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | Meson changes for QEMU 8.0 | expand |
Hi On Fri, Dec 9, 2022 at 3:36 PM Paolo Bonzini <pbonzini@redhat.com> wrote: > > -Wl,--dynamicbase has been enabled for DLLs upstream for roughly 2 > years (https://sourceware.org/bugzilla/show_bug.cgi?id=19011), and > also by some distros including Debian for 6 years even > (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836365), so > just enable it unconditionally. > > Also add -Wl,--high-entropy-va. > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > meson.build | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) > > diff --git a/meson.build b/meson.build > index 5c6b5a1c757f..d61c7a82f112 100644 > --- a/meson.build > +++ b/meson.build > @@ -193,10 +193,7 @@ qemu_ldflags += cc.get_supported_link_arguments('-Wl,-z,relro', '-Wl,-z,now') > > if targetos == 'windows' > qemu_ldflags += cc.get_supported_link_arguments('-Wl,--no-seh', '-Wl,--nxcompat') > - # Disable ASLR for debug builds to allow debugging with gdb > - if get_option('optimization') == '0' > - qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase') > - endif > + qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase', '-Wl,--high-entropy-va') What about the comment for disabling ASLR on debug builds? I wonder if we really have to add those flags ourself. Imho, we can leave them to the compiler default or distrib.. I bet most of the deps don't use those flags explicitly either.
On 12/12/22 09:18, Marc-André Lureau wrote: >> - # Disable ASLR for debug builds to allow debugging with gdb >> - if get_option('optimization') == '0' >> - qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase') >> - endif >> + qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase', '-Wl,--high-entropy-va') > > What about the comment for disabling ASLR on debug builds? The problem with that line is that it _enables_ ASLR for debug builds, and nobody has complained about gdb since last April... And nobody has complained to Debian or other distros that have enabled the flag for years now. I'll clarify the commit message. > I wonder if we really have to add those flags ourself. Imho, we can > leave them to the compiler default or distrib.. I bet most of the deps > don't use those flags explicitly either. I think so, at least Firefox does. In general QEMU tries to do more build-time hardening than the average pacakge. Paolo
On Fri, Dec 09, 2022 at 12:23:45PM +0100, Paolo Bonzini wrote: > -Wl,--dynamicbase has been enabled for DLLs upstream for roughly 2 > years (https://sourceware.org/bugzilla/show_bug.cgi?id=19011), and > also by some distros including Debian for 6 years even > (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836365), so > just enable it unconditionally. > > Also add -Wl,--high-entropy-va. > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > meson.build | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> With regards, Daniel
diff --git a/meson.build b/meson.build index 5c6b5a1c757f..d61c7a82f112 100644 --- a/meson.build +++ b/meson.build @@ -193,10 +193,7 @@ qemu_ldflags += cc.get_supported_link_arguments('-Wl,-z,relro', '-Wl,-z,now') if targetos == 'windows' qemu_ldflags += cc.get_supported_link_arguments('-Wl,--no-seh', '-Wl,--nxcompat') - # Disable ASLR for debug builds to allow debugging with gdb - if get_option('optimization') == '0' - qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase') - endif + qemu_ldflags += cc.get_supported_link_arguments('-Wl,--dynamicbase', '-Wl,--high-entropy-va') endif if get_option('gprof')
-Wl,--dynamicbase has been enabled for DLLs upstream for roughly 2 years (https://sourceware.org/bugzilla/show_bug.cgi?id=19011), and also by some distros including Debian for 6 years even (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836365), so just enable it unconditionally. Also add -Wl,--high-entropy-va. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> --- meson.build | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)