Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 6 Nov 2011 20:59:42 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: %optflags for new gcc

On Sun, Nov 06, 2011 at 20:23 +0400, Vasiliy Kulikov wrote:
> I cannot find what wrong can happen with -z,now.  I'm finding only bug
> in ld's implementation of "-z now" :-)

Here it is:

http://www.gentoo.org/proj/en/hardened/hardened-toolchain.xml#NOWissues

"The second more serious effect is that applications that are not written
to refer to shared libraries in the standard way can fail; the most
obvious of these is X, which has modules with circular resolution
dependencies amongst other unusual behaviour. Another trick occasionally
performed by applications is to decide between a number of shared
libraries at run time, and use lazy binding to resolve references to the
chosen library. Normally this would be done with dlopen(3) and friends,
including obtaining symbol addresses via dlsym(3), but it is possible to
avoid using dlsym(3) and a plethora of pointers in the code by using
lazy binding, although it's not pretty.

The following packages have issues with BIND_NOW at the time of writing,
and it has to be relaxed somewhat for them:

    X - some drivers consist of several libraries which are
        co-dependent, and the modules frequently have references to modules
        that they load.
    transcode - relies on lazy binding to be able to load its
        modules; the issues are similar to the X issues."

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ