[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130512190742.GA6822@cachalot>
Date: Sun, 12 May 2013 23:07:42 +0400
From: Vasily Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: PIE on x86_64
On Wed, May 01, 2013 at 20:00 +0400, Vasily Kulikov wrote:
> > [root@...vista tmp]# gcc -specs=spec -DABC -E -c -
> > gcc: ABC is used!
> > [root@...vista tmp]# gcc -specs=spec -E -c -
> > gcc: ABC is not used!
> > [root@...vista tmp]# gcc --version
> > gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-54)
>
> The same on Owl 3.0:
>
> $ gcc --version | head -n1
> gcc (GCC) 3.4.5
> build@...halot:~ $ gcc -specs=gcc-specs -E -c -
> gcc: ABC is not used!
> build@...halot:~ $ gcc -specs=gcc-specs -DABC -E -c -
> gcc: ABC is used!
>
> But not on Owl current with gcc 4.6.3 and on Ubuntu 12.04 with gcc
> 4.6.3.
Anyway, I've finally compiled almost all Owl packages as PIE.
The exceptions:
build@...halot:~ $ for f in /{usr/,}{s,}bin/*; do ! [ -h $f ] && readelf -h $f >/dev/null 2>&1 && readelf -h $f | grep Type | grep -q EXEC && ldd $f >/dev/null 2>&1 && echo $f; done | xargs rpm -qf | sort | uniq
glibc-utils-2.3.6-owl21
build@...halot:~ $ for f in /{usr/,}{s,}bin/*; do ! [ -h $f ] && readelf -h $f >/dev/null 2>&1 && readelf -h $f | grep Type | grep -q EXEC && ldd $f >/dev/null 2>&1 && echo $f; done
/usr/sbin/iconvconfig
/usr/sbin/rpcinfo
/usr/sbin/zdump
/usr/sbin/zic
/usr/bin/gencat
/usr/bin/getconf
/usr/bin/getent
/usr/bin/iconv
/usr/bin/lddlibc4
/usr/bin/locale
/usr/bin/localedef
/usr/bin/pcprofiledump
/usr/bin/rpcgen
/usr/bin/sprof
Probably these should be made PIE too. I haven't digged into it yet,
though.
The packages which fails to build as-is:
x86_64:
kernel -- need a patch
owl-startup, vim -- builds ok after their dependencies rebuild-install
x86:
kernel -- the same, need a patch
dev86 -- builds ok with -fno-pic for elksemu
rpm -- add --with-pic configure option and add a simple patch
glibc -- added a patch from hardened gentoo
As for kernel I've added an explicit -fno-pic into kernel (not VDSO,
etc.) CFLAGS.
After patching and rebuilding everything looks OK and seems to work.
World rebuild works.
Now I have to investigate whether anything was made much slower in case
of -fPIE.
--
Vasily Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
