Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 12 May 2013 23:07:42 +0400
From: Vasily Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: PIE on x86_64

On Wed, May 01, 2013 at 20:00 +0400, Vasily Kulikov wrote:
> > [root@...vista tmp]# gcc -specs=spec -DABC -E -c -
> > gcc: ABC is used!
> > [root@...vista tmp]# gcc -specs=spec -E -c -
> > gcc: ABC is not used!
> > [root@...vista tmp]# gcc --version
> > gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-54)
> 
> The same on Owl 3.0:
> 
> $ gcc --version | head -n1
> gcc (GCC) 3.4.5
> build@...halot:~ $ gcc -specs=gcc-specs -E -c -
> gcc: ABC is not used!
> build@...halot:~ $ gcc -specs=gcc-specs -DABC -E -c -
> gcc: ABC is used!
> 
> But not on Owl current with gcc 4.6.3 and on Ubuntu 12.04 with gcc
> 4.6.3.

Anyway, I've finally compiled almost all Owl packages as PIE.

The exceptions:

    build@...halot:~ $ for f in /{usr/,}{s,}bin/*; do ! [ -h $f ] && readelf -h $f >/dev/null 2>&1 && readelf -h $f | grep Type | grep -q EXEC && ldd $f >/dev/null 2>&1 && echo $f; done | xargs rpm -qf | sort | uniq
    glibc-utils-2.3.6-owl21
    build@...halot:~ $ for f in /{usr/,}{s,}bin/*; do ! [ -h $f ] && readelf -h $f >/dev/null 2>&1 && readelf -h $f | grep Type | grep -q EXEC && ldd $f >/dev/null 2>&1 && echo $f; done 
    /usr/sbin/iconvconfig
    /usr/sbin/rpcinfo
    /usr/sbin/zdump
    /usr/sbin/zic
    /usr/bin/gencat
    /usr/bin/getconf
    /usr/bin/getent
    /usr/bin/iconv
    /usr/bin/lddlibc4
    /usr/bin/locale
    /usr/bin/localedef
    /usr/bin/pcprofiledump
    /usr/bin/rpcgen
    /usr/bin/sprof

Probably these should be made PIE too.  I haven't digged into it yet,
though.

The packages which fails to build as-is:

x86_64:

    kernel -- need a patch
    owl-startup, vim -- builds ok after their dependencies rebuild-install

x86:

    kernel -- the same, need a patch
    dev86 -- builds ok with -fno-pic for elksemu
    rpm -- add --with-pic configure option and add a simple patch
    glibc -- added a patch from hardened gentoo

As for kernel I've added an explicit -fno-pic into kernel (not VDSO,
etc.) CFLAGS.

After patching and rebuilding everything looks OK and seems to work.
World rebuild works.

Now I have to investigate whether anything was made much slower in case
of -fPIE.

-- 
Vasily Kulikov
http://www.openwall.com - bringing security into open computing environments

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ