Re: Fwd: [Fedora-packaging] [HEADS UP] libtool + %global _hardened_build 1 = no full hardening

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Yes, it applies to us. Good catch.


On 06/26/2013 07:26 PM, Joe Julian wrote:
This applies to us, does it not?


-------- Original Message --------
Subject: 	[Fedora-packaging] [HEADS UP] libtool + %global
_hardened_build 1 = no full hardening
Date: 	Wed, 26 Jun 2013 17:39:07 +0200
From: 	Björn Esser <bjoern.esser@xxxxxxxxx>
Reply-To: 	Discussion of RPM packaging standards and practices for
Fedora <packaging@xxxxxxxxxxxxxxxxxxxxxxx>
To: 	packaging@xxxxxxxxxxxxxxxxxxxxxxx, devel@xxxxxxxxxxxxxxxxxxxxxxx



Hello list!

As discussed a few days ago [1] there's a _severe_ bug in autotool's
libtool known for ages [2] preventing libs not to be build fully
hardened (partial RELRO), even if you have included `%global
_hardened_build 1` into you rpm-spec.

There was some LDFLAGS-hack [3] mentioned by me during review of
bz# 977446 nbdkit, which turned out to block proper exporting of LDFLAGS
during `%configure`-invocation.  So I did some experiments how to get a
proper working and future aware solution for this.

I recommend EVERYBODY, who maintains pkgs meeting the above criteria
(libtool + hardening) to re-check their build pkg's proper hardening
invoking `hardening-check --color --verbose $path_to_lib` and if it's
report reveals

       ...
       Read-only relocations: yes
--->  Immediate binding: no, not found!  <---

to apply the following lines immediatly AFTER invoking `%configure` to
their affected pkg's spec:

# dirty hack to force immediate binding with hardenend build having
# autocrap's libtool pass the need gcc-specs to linker.
sed -i -e 's! \\\$compiler_flags !&\\\$CFLAGS \\\$LDFLAGS !' libtool

This simple (but effective) hack makes sure ALL hardening-relevant flags
are passed to the linker.

I just filed a ticket for FESCo-meeting [4] to have this workaround
included in `%configure`-macro provided by rpm-package.

If you are unsure whether your package is affected this feel free to ask
me and please provide a build.log, so I can check.

Cheers,
   Björn

[1]https://lists.fedoraproject.org/pipermail/devel/2013-June/184429.html
[2]http://lists.gnu.org/archive/html/bug-libtool/2005-10/msg00003.html
[3]https://bugzilla.redhat.com/show_bug.cgi?id=977446#c13
[4]https://fedorahosted.org/fesco/ticket/1132






_______________________________________________
Gluster-devel mailing list
Gluster-devel@xxxxxxxxxx
https://lists.nongnu.org/mailman/listinfo/gluster-devel





[Index of Archives]     [Gluster Users]     [Ceph Users]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux