|
 |
147e83 |
This patch is based on the following upstream commit:
|
|
|
147e83 |
|
|
|
147e83 |
commit 94a4e9e4f401ffe829a992820439977ead0a0ce7
|
|
|
147e83 |
Author: Florian Weimer <fweimer@redhat.com>
|
|
|
147e83 |
Date: Thu Apr 25 10:41:43 2019 +0200
|
|
|
147e83 |
|
|
|
147e83 |
Extend BIND_NOW to installed programs with --enable-bind-now
|
|
|
147e83 |
|
|
|
147e83 |
Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix
|
|
|
147e83 |
--enable-bind-now [BZ #21015]") extended BIND_NOW to all installed
|
|
|
147e83 |
shared objects. This change also covers installed programs.
|
|
|
147e83 |
|
|
|
147e83 |
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
|
|
147e83 |
|
|
|
147e83 |
diff --git a/INSTALL b/INSTALL
|
|
|
147e83 |
index 230be71b9d0821c2..277ea46d9c25a9ae 100644
|
|
|
147e83 |
--- a/INSTALL
|
|
|
147e83 |
+++ b/INSTALL
|
|
|
147e83 |
@@ -144,10 +144,10 @@ will be used, and CFLAGS sets optimization options for the compiler.
|
|
|
147e83 |
Enable lock elision for pthread mutexes by default.
|
|
|
147e83 |
|
|
|
147e83 |
'--enable-bind-now'
|
|
|
147e83 |
- Disable lazy binding for installed shared objects. This provides
|
|
|
147e83 |
- additional security hardening because it enables full RELRO and a
|
|
|
147e83 |
- read-only global offset table (GOT), at the cost of slightly
|
|
|
147e83 |
- increased program load times.
|
|
|
147e83 |
+ Disable lazy binding for installed shared objects and programs.
|
|
|
147e83 |
+ This provides additional security hardening because it enables full
|
|
|
147e83 |
+ RELRO and a read-only global offset table (GOT), at the cost of
|
|
|
147e83 |
+ slightly increased program load times.
|
|
|
147e83 |
|
|
|
147e83 |
`--disable-werror'
|
|
|
147e83 |
By default, the GNU C Library is built with `-Werror'. If you wish
|
|
|
147e83 |
diff --git a/Makeconfig b/Makeconfig
|
|
|
147e83 |
index 1ad9b6f0d494c027..bc13b39c2ea5708a 100644
|
|
|
147e83 |
--- a/Makeconfig
|
|
|
147e83 |
+++ b/Makeconfig
|
|
|
147e83 |
@@ -389,6 +389,8 @@ endif
|
|
|
147e83 |
# test modules.
|
|
|
147e83 |
ifeq ($(bind-now),yes)
|
|
|
147e83 |
LDFLAGS-lib.so += -Wl,-z,now
|
|
|
147e83 |
+# Extra flags for dynamically linked non-test main programs.
|
|
|
147e83 |
+link-extra-flags += -Wl,-z,now
|
|
|
147e83 |
endif
|
|
|
147e83 |
|
|
|
147e83 |
# Additional libraries to link into every test.
|
|
|
147e83 |
@@ -405,7 +407,8 @@ ifndef +link-pie
|
|
|
147e83 |
S$(start-installed-name))\
|
|
|
147e83 |
$(+preinit) $(link-extra-libs) \
|
|
|
147e83 |
$(common-objpfx)libc% $(+postinit),$^) \
|
|
|
147e83 |
- $(link-extra-libs) $(link-libc) $(+postctorS) $(+postinit)
|
|
|
147e83 |
+ $(link-extra-libs) $(link-extra-flags) $(link-libc) \
|
|
|
147e83 |
+ $(+postctorS) $(+postinit)
|
|
|
147e83 |
endif
|
|
|
147e83 |
# Command for statically linking programs with the C library.
|
|
|
147e83 |
ifndef +link-static
|
|
|
147e83 |
@@ -419,8 +422,8 @@ ifndef +link-static
|
|
|
147e83 |
$(common-objpfx)libc% $(+postinit),$^) \
|
|
|
147e83 |
$(link-extra-libs-static)
|
|
|
147e83 |
+link-static-after-libc = $(+postctorT) $(+postinit)
|
|
|
147e83 |
-+link-static = $(+link-static-before-libc) $(link-libc-static) \
|
|
|
147e83 |
- $(+link-static-after-libc)
|
|
|
147e83 |
++link-static = $(+link-static-before-libc) $(link-extra-flags) \
|
|
|
147e83 |
+ $(link-libc-static) $(+link-static-after-libc)
|
|
|
147e83 |
+link-static-tests = $(+link-static-before-libc) $(link-libc-static-tests) \
|
|
|
147e83 |
$(+link-static-after-libc)
|
|
|
147e83 |
endif
|
|
|
147e83 |
@@ -438,7 +441,8 @@ ifeq (yes,$(build-shared))
|
|
|
147e83 |
$(common-objpfx)libc% $(+postinit),$^) \
|
|
|
147e83 |
$(link-extra-libs)
|
|
|
147e83 |
+link-after-libc = $(+postctor) $(+postinit)
|
|
|
147e83 |
-+link = $(+link-before-libc) $(link-libc) $(+link-after-libc)
|
|
|
147e83 |
++link = $(+link-before-libc) $(link-extra-flags) $(link-libc) \
|
|
|
147e83 |
+ $(+link-after-libc)
|
|
|
147e83 |
+link-tests = $(+link-before-libc) $(link-libc-tests) $(+link-after-libc)
|
|
|
147e83 |
else
|
|
|
147e83 |
+link = $(+link-static)
|
|
|
147e83 |
diff --git a/manual/install.texi b/manual/install.texi
|
|
|
147e83 |
index 47d832cc59bc695e..5cacd974ce093ce9 100644
|
|
|
147e83 |
--- a/manual/install.texi
|
|
|
147e83 |
+++ b/manual/install.texi
|
|
|
147e83 |
@@ -161,10 +161,10 @@ so that they can be invoked directly.
|
|
|
147e83 |
Enable lock elision for pthread mutexes by default.
|
|
|
147e83 |
|
|
|
147e83 |
@item --enable-bind-now
|
|
|
147e83 |
-Disable lazy binding for installed shared objects. This provides
|
|
|
147e83 |
-additional security hardening because it enables full RELRO and a
|
|
|
147e83 |
-read-only global offset table (GOT), at the cost of slightly increased
|
|
|
147e83 |
-program load times.
|
|
|
147e83 |
+Disable lazy binding for installed shared objects and programs. This
|
|
|
147e83 |
+provides additional security hardening because it enables full RELRO
|
|
|
147e83 |
+and a read-only global offset table (GOT), at the cost of slightly
|
|
|
147e83 |
+increased program load times.
|
|
|
147e83 |
|
|
|
147e83 |
@pindex pt_chown
|
|
|
147e83 |
@findex grantpt
|