AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-24 22:10:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Extend BIND_NOW to installed programs with --enable-bind-now

Browse Source 
Commit 2d6ab5df3b ("Document and fix
--enable-bind-now [BZ #21015]") extended BIND_NOW to all installed
shared objects.  This change also covers installed programs.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
This commit is contained in:
Florian Weimer 2019-04-25 10:41:43 +02:00
parent fe92a91f1e
commit 94a4e9e4f4
5 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2019-04-25 Florian Weimer <fweimer@redhat.com>
Also enable BIND_NOW for programs if --enable-bind-now.
* Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now.
(+link-pie): Use $(link-extra-flags).
(+link-static): Likewise.
[! $(build-pie-default)] (+link): Likewise.
* manual/install.texi (Configuring and compiling): Update
--enable-bind-now description.
* INSTALL: Regenerated.
2019-04-24 Wilco Dijkstra <wdijkstr@arm.com> 2019-04-24 Wilco Dijkstra <wdijkstr@arm.com>
* benchtests/Makefile (BENCH_DURATION): Set to 1 second. * benchtests/Makefile (BENCH_DURATION): Set to 1 second.

8
INSTALL
View File

@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization. For example:
protection. protection.
'--enable-bind-now' '--enable-bind-now'
Disable lazy binding for installed shared objects. This provides Disable lazy binding for installed shared objects and programs.
additional security hardening because it enables full RELRO and a This provides additional security hardening because it enables full
read-only global offset table (GOT), at the cost of slightly RELRO and a read-only global offset table (GOT), at the cost of
increased program load times. slightly increased program load times.
'--enable-pt_chown' '--enable-pt_chown'
The file 'pt_chown' is a helper binary for 'grantpt' (*note The file 'pt_chown' is a helper binary for 'grantpt' (*note

8
Makeconfig
View File

@ -398,6 +398,8 @@ endif
# test modules. # test modules.
ifeq ($(bind-now),yes) ifeq ($(bind-now),yes)
LDFLAGS-lib.so += -Wl,-z,now LDFLAGS-lib.so += -Wl,-z,now
# Extra flags for dynamically linked non-test main programs.
link-extra-flags += -Wl,-z,now
endif endif
# Command to run after every final link (executable or shared object). # Command to run after every final link (executable or shared object).
@ -426,7 +428,7 @@ ifndef +link-pie
$(link-extra-libs) $(link-extra-libs)
+link-pie-after-libc = $(+postctorS) $(+postinit) +link-pie-after-libc = $(+postctorS) $(+postinit)
define +link-pie define +link-pie
$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc) $(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
$(call after-link,$@) $(call after-link,$@)
endef endef
define +link-pie-tests define +link-pie-tests
@ -454,7 +456,7 @@ ifndef +link-static
$(link-extra-libs-static) $(link-extra-libs-static)
+link-static-after-libc = $(+postctorT) $(+postinit) +link-static-after-libc = $(+postctorT) $(+postinit)
define +link-static define +link-static
$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc) $(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
$(call after-link,$@) $(call after-link,$@)
endef endef
define +link-static-tests define +link-static-tests
@ -485,7 +487,7 @@ else # not build-pie-default
$(link-extra-libs) $(link-extra-libs)
+link-after-libc = $(+postctor) $(+postinit) +link-after-libc = $(+postctor) $(+postinit)
define +link define +link
$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc) $(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
$(call after-link,$@) $(call after-link,$@)
endef endef
define +link-tests define +link-tests

3
NEWS
View File

@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility:
* The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub
resolver have been removed from <resolv.h>. resolver have been removed from <resolv.h>.
* With --enable-bind-now, installed programs are now linked with the
BIND_NOW flag.
Changes to build and runtime requirements: Changes to build and runtime requirements:
* GCC 6.2 or later is required to build the GNU C Library. * GCC 6.2 or later is required to build the GNU C Library.

8
manual/install.texi
View File

@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this
protection. protection.
@item --enable-bind-now @item --enable-bind-now
Disable lazy binding for installed shared objects. This provides Disable lazy binding for installed shared objects and programs. This
additional security hardening because it enables full RELRO and a provides additional security hardening because it enables full RELRO
read-only global offset table (GOT), at the cost of slightly increased and a read-only global offset table (GOT), at the cost of slightly
program load times. increased program load times.
@pindex pt_chown @pindex pt_chown
@findex grantpt @findex grantpt