From patchwork Wed Apr 24 10:18:19 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 1090043 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-101585-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="W/mlJ+vq"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44px9L3MdKz9s4Y for ; Wed, 24 Apr 2019 20:18:29 +1000 (AEST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; q=dns; s=default; b=KX2TP2RlH/40XxImhbcPTK2lzDUDX LPiPZIp8+O09+QWMQptM4hsPlCMaxwqM4kw6yUmap/dFWiTc6NMF/woc0iEc6JPw bGf7G0CRx9ZcwJZsVtgtZ0GJ4YTnepKeaTksmajEzZugg0UVhaq/hRSJWdYkLlK2 cvbRkgLgj0PGtw= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; s=default; bh=FrbYMIAstgQ58OX8Im0SiN55Ggg=; b=W/m lJ+vqRv5GbgJxbzXCiw3Sd/TAQEa/d+aHr9QVHwl3Mguwp8EAW1/QaoxYqnlcni4 w3l0IGsLdLXRoMGcOKFVpZDWJiKeYTBGtH+z1UaWmc9QWUZLQHe0QW1RR3kSz/rT YuXSmSI/Dm6DOMgdVMddzlygglPD+HclY3De3JyA= Received: (qmail 121609 invoked by alias); 24 Apr 2019 10:18:24 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 121600 invoked by uid 89); 24 Apr 2019 10:18:24 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-18.4 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, SPF_HELO_PASS autolearn=ham version=3.3.1 spammy= X-HELO: mx1.redhat.com From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH] Extend BIND_NOW to installed programs with --enable-bind-now Date: Wed, 24 Apr 2019 12:18:19 +0200 Message-ID: <87h8anr9jo.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 We received guidance that we should also enable BIND_NOW for installed programs. I think we can reuse the --enable-bind-now flag for that. Thanks, Florian Reviewed-by: Carlos O'Donell --- Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix --enable-bind-now [BZ #21015]") extended BIND_NOW to all installed shared objects. This change also covers installed programs. 2019-04-24 Florian Weimer Also enable BIND_NOW for programs if --enable-bind-now. * Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now. (+link-pie): Use $(link-extra-flags). [! $(build-pie-default)] (+link): Likewise. * manual/install.texi (Configuring and compiling): Update --enable-bind-now description. * INSTALL: Regenerated. diff --git a/INSTALL b/INSTALL index ddb9e9018d..e137a71169 100644 --- a/INSTALL +++ b/INSTALL @@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization. For example: protection. '--enable-bind-now' - Disable lazy binding for installed shared objects. This provides - additional security hardening because it enables full RELRO and a - read-only global offset table (GOT), at the cost of slightly - increased program load times. + Disable lazy binding for installed shared objects and programs. + This provides additional security hardening because it enables full + RELRO and a read-only global offset table (GOT), at the cost of + slightly increased program load times. '--enable-pt_chown' The file 'pt_chown' is a helper binary for 'grantpt' (*note diff --git a/Makeconfig b/Makeconfig index 07007c9459..768df2c3ef 100644 --- a/Makeconfig +++ b/Makeconfig @@ -398,6 +398,8 @@ endif # test modules. ifeq ($(bind-now),yes) LDFLAGS-lib.so += -Wl,-z,now +# Extra flags for dynamically linked non-test main programs. +link-extra-flags += -Wl,-z,now endif # Command to run after every final link (executable or shared object). @@ -426,7 +428,7 @@ ifndef +link-pie $(link-extra-libs) +link-pie-after-libc = $(+postctorS) $(+postinit) define +link-pie -$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc) +$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc) $(call after-link,$@) endef define +link-pie-tests @@ -485,7 +487,7 @@ else # not build-pie-default $(link-extra-libs) +link-after-libc = $(+postctor) $(+postinit) define +link -$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc) +$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc) $(call after-link,$@) endef define +link-tests diff --git a/NEWS b/NEWS index 63581b3618..792ffb1ec8 100644 --- a/NEWS +++ b/NEWS @@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility: * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub resolver have been removed from . +* With --enable-bind-now, installed programs are now linked with the + BIND_NOW flag. + Changes to build and runtime requirements: * GCC 6.2 or later is required to build the GNU C Library. diff --git a/manual/install.texi b/manual/install.texi index a9b8b4974c..29f6b68e25 100644 --- a/manual/install.texi +++ b/manual/install.texi @@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this protection. @item --enable-bind-now -Disable lazy binding for installed shared objects. This provides -additional security hardening because it enables full RELRO and a -read-only global offset table (GOT), at the cost of slightly increased -program load times. +Disable lazy binding for installed shared objects and programs. This +provides additional security hardening because it enables full RELRO +and a read-only global offset table (GOT), at the cost of slightly +increased program load times. @pindex pt_chown @findex grantpt