9832fd
This patch is based on the following upstream commit:
9832fd
9832fd
commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9
9832fd
Author: Florian Weimer <fweimer@redhat.com>
9832fd
Date:   Thu Mar 2 14:44:28 2017 +0100
9832fd
9832fd
    Document and fix --enable-bind-now [BZ #21015]
9832fd
9832fd
diff --git a/INSTALL b/INSTALL
9832fd
index 82b29f5d8746f929..230be71b9d0821c2 100644
9832fd
--- a/INSTALL
9832fd
+++ b/INSTALL
9832fd
@@ -143,6 +143,12 @@ will be used, and CFLAGS sets optimization options for the compiler.
9832fd
 `--enable-lock-elision=yes'
9832fd
      Enable lock elision for pthread mutexes by default.
9832fd
 
9832fd
+'--enable-bind-now'
9832fd
+     Disable lazy binding for installed shared objects.  This provides
9832fd
+     additional security hardening because it enables full RELRO and a
9832fd
+     read-only global offset table (GOT), at the cost of slightly
9832fd
+     increased program load times.
9832fd
+
9832fd
 `--disable-werror'
9832fd
      By default, the GNU C Library is built with `-Werror'.  If you wish
9832fd
      to build without this option (for example, if building with a newer
9832fd
diff --git a/Makeconfig b/Makeconfig
9832fd
index f8313c9774d47522..1ad9b6f0d494c027 100644
9832fd
--- a/Makeconfig
9832fd
+++ b/Makeconfig
9832fd
@@ -384,6 +384,13 @@ LDFLAGS.so += $(hashstyle-LDFLAGS)
9832fd
 LDFLAGS-rtld += $(hashstyle-LDFLAGS)
9832fd
 endif
9832fd
 
9832fd
+# If lazy relocations are disabled, add the -z now flag.  Use
9832fd
+# LDFLAGS-lib.so instead of LDFLAGS.so, to avoid adding the flag to
9832fd
+# test modules.
9832fd
+ifeq ($(bind-now),yes)
9832fd
+LDFLAGS-lib.so += -Wl,-z,now
9832fd
+endif
9832fd
+
9832fd
 # Additional libraries to link into every test.
9832fd
 link-extra-libs-tests = $(libsupport)
9832fd
 
9832fd
diff --git a/Makerules b/Makerules
9832fd
index 9bd7d603fc28a4de..50fe7e48187f0e68 100644
9832fd
--- a/Makerules
9832fd
+++ b/Makerules
9832fd
@@ -477,7 +477,7 @@ $(LINK.o) -shared $(static-libgcc) -Wl,-O1 $(sysdep-LDFLAGS) \
9832fd
 	  $(extra-B-$(@F:lib%.so=%).so) -B$(csu-objpfx) \
9832fd
 	  $(extra-B-$(@F:lib%.so=%).so) $(load-map-file) \
9832fd
 	  -Wl,-soname=lib$(libprefix)$(@F:lib%.so=%).so$($(@F)-version) \
9832fd
-	  $(LDFLAGS.so) $(LDFLAGS-$(@F:lib%.so=%).so) \
9832fd
+	  $(LDFLAGS.so) $(LDFLAGS-lib.so) $(LDFLAGS-$(@F:lib%.so=%).so) \
9832fd
 	  -L$(subst :, -L,$(rpath-link)) -Wl,-rpath-link=$(rpath-link)
9832fd
 endef
9832fd
 
9832fd
@@ -938,7 +938,8 @@ $(common-objpfx)format.lds: $(..)scripts/output-format.sed \
9832fd
 ifneq (unknown,$(output-format))
9832fd
 	echo > $@.new 'OUTPUT_FORMAT($(output-format))'
9832fd
 else
9832fd
-	$(LINK.o) -shared $(sysdep-LDFLAGS) $(config-LDFLAGS) $(LDFLAGS.so) \
9832fd
+	$(LINK.o) -shared $(sysdep-LDFLAGS) $(config-LDFLAGS) \
9832fd
+		  $(LDFLAGS.so) $(LDFLAGS-lib.so) \
9832fd
 		  -x c /dev/null -o $@.so -Wl,--verbose -v 2>&1 \
9832fd
 	| sed -n -f $< > $@.new
9832fd
 	test -s $@.new
9832fd
diff --git a/iconvdata/Makefile b/iconvdata/Makefile
9832fd
index 7930dcd49d77c818..ddb2dc6a3c6500c8 100644
9832fd
--- a/iconvdata/Makefile
9832fd
+++ b/iconvdata/Makefile
9832fd
@@ -65,6 +65,10 @@ modules.so := $(addsuffix .so, $(modules))
9832fd
 
9832fd
 include ../Makeconfig
9832fd
 
9832fd
+ifeq ($(bind-now),yes)
9832fd
+LDFLAGS.so += -Wl,-z,now
9832fd
+endif
9832fd
+
9832fd
 ifeq (yes,$(build-shared))
9832fd
 tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
9832fd
 	tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
9832fd
diff --git a/manual/install.texi b/manual/install.texi
9832fd
index 3799cee621ddc4f9..47d832cc59bc695e 100644
9832fd
--- a/manual/install.texi
9832fd
+++ b/manual/install.texi
9832fd
@@ -160,6 +160,12 @@ so that they can be invoked directly.
9832fd
 @item --enable-lock-elision=yes
9832fd
 Enable lock elision for pthread mutexes by default.
9832fd
 
9832fd
+@item --enable-bind-now
9832fd
+Disable lazy binding for installed shared objects.  This provides
9832fd
+additional security hardening because it enables full RELRO and a
9832fd
+read-only global offset table (GOT), at the cost of slightly increased
9832fd
+program load times.
9832fd
+
9832fd
 @pindex pt_chown
9832fd
 @findex grantpt
9832fd
 @item --enable-pt_chown