|
 |
bdc76f |
commit 94a4e9e4f401ffe829a992820439977ead0a0ce7
|
|
|
bdc76f |
Author: Florian Weimer <fweimer@redhat.com>
|
|
|
bdc76f |
Date: Thu Apr 25 10:41:43 2019 +0200
|
|
|
bdc76f |
|
|
|
bdc76f |
Extend BIND_NOW to installed programs with --enable-bind-now
|
|
|
bdc76f |
|
|
|
bdc76f |
Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix
|
|
|
bdc76f |
--enable-bind-now [BZ #21015]") extended BIND_NOW to all installed
|
|
|
bdc76f |
shared objects. This change also covers installed programs.
|
|
|
bdc76f |
|
|
|
bdc76f |
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
|
|
bdc76f |
|
|
|
bdc76f |
diff --git a/INSTALL b/INSTALL
|
|
|
bdc76f |
index d6c8e899fbb47dac..d56e102ec9ed3281 100644
|
|
|
bdc76f |
--- a/INSTALL
|
|
|
bdc76f |
+++ b/INSTALL
|
|
|
bdc76f |
@@ -169,10 +169,10 @@ if 'CFLAGS' is specified it must enable optimization. For example:
|
|
|
bdc76f |
protection.
|
|
|
bdc76f |
|
|
|
bdc76f |
'--enable-bind-now'
|
|
|
bdc76f |
- Disable lazy binding for installed shared objects. This provides
|
|
|
bdc76f |
- additional security hardening because it enables full RELRO and a
|
|
|
bdc76f |
- read-only global offset table (GOT), at the cost of slightly
|
|
|
bdc76f |
- increased program load times.
|
|
|
bdc76f |
+ Disable lazy binding for installed shared objects and programs.
|
|
|
bdc76f |
+ This provides additional security hardening because it enables full
|
|
|
bdc76f |
+ RELRO and a read-only global offset table (GOT), at the cost of
|
|
|
bdc76f |
+ slightly increased program load times.
|
|
|
bdc76f |
|
|
|
bdc76f |
'--enable-pt_chown'
|
|
|
bdc76f |
The file 'pt_chown' is a helper binary for 'grantpt' (*note
|
|
|
bdc76f |
diff --git a/Makeconfig b/Makeconfig
|
|
|
bdc76f |
index 8dc2fec9dc683416..742c0c0783a14bfa 100644
|
|
|
bdc76f |
--- a/Makeconfig
|
|
|
bdc76f |
+++ b/Makeconfig
|
|
|
bdc76f |
@@ -398,6 +398,8 @@ endif
|
|
|
bdc76f |
# test modules.
|
|
|
bdc76f |
ifeq ($(bind-now),yes)
|
|
|
bdc76f |
LDFLAGS-lib.so += -Wl,-z,now
|
|
|
bdc76f |
+# Extra flags for dynamically linked non-test main programs.
|
|
|
bdc76f |
+link-extra-flags += -Wl,-z,now
|
|
|
bdc76f |
endif
|
|
|
bdc76f |
|
|
|
bdc76f |
# Command to run after every final link (executable or shared object).
|
|
|
bdc76f |
@@ -426,7 +428,7 @@ ifndef +link-pie
|
|
|
bdc76f |
$(link-extra-libs)
|
|
|
bdc76f |
+link-pie-after-libc = $(+postctorS) $(+postinit)
|
|
|
bdc76f |
define +link-pie
|
|
|
bdc76f |
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
|
|
|
bdc76f |
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
|
|
|
bdc76f |
$(call after-link,$@)
|
|
|
bdc76f |
endef
|
|
|
bdc76f |
define +link-pie-tests
|
|
|
bdc76f |
@@ -454,7 +456,7 @@ ifndef +link-static
|
|
|
bdc76f |
$(link-extra-libs-static)
|
|
|
bdc76f |
+link-static-after-libc = $(+postctorT) $(+postinit)
|
|
|
bdc76f |
define +link-static
|
|
|
bdc76f |
-$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)
|
|
|
bdc76f |
+$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
|
|
|
bdc76f |
$(call after-link,$@)
|
|
|
bdc76f |
endef
|
|
|
bdc76f |
define +link-static-tests
|
|
|
bdc76f |
@@ -485,7 +487,7 @@ else # not build-pie-default
|
|
|
bdc76f |
$(link-extra-libs)
|
|
|
bdc76f |
+link-after-libc = $(+postctor) $(+postinit)
|
|
|
bdc76f |
define +link
|
|
|
bdc76f |
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
|
|
|
bdc76f |
+$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
|
|
|
bdc76f |
$(call after-link,$@)
|
|
|
bdc76f |
endef
|
|
|
bdc76f |
define +link-tests
|
|
|
bdc76f |
diff --git a/manual/install.texi b/manual/install.texi
|
|
|
bdc76f |
index e757891dc2eebb2e..351d67c68b255f62 100644
|
|
|
bdc76f |
--- a/manual/install.texi
|
|
|
bdc76f |
+++ b/manual/install.texi
|
|
|
bdc76f |
@@ -199,10 +199,10 @@ number of routines called directly from assembler are excluded from this
|
|
|
bdc76f |
protection.
|
|
|
bdc76f |
|
|
|
bdc76f |
@item --enable-bind-now
|
|
|
bdc76f |
-Disable lazy binding for installed shared objects. This provides
|
|
|
bdc76f |
-additional security hardening because it enables full RELRO and a
|
|
|
bdc76f |
-read-only global offset table (GOT), at the cost of slightly increased
|
|
|
bdc76f |
-program load times.
|
|
|
bdc76f |
+Disable lazy binding for installed shared objects and programs. This
|
|
|
bdc76f |
+provides additional security hardening because it enables full RELRO
|
|
|
bdc76f |
+and a read-only global offset table (GOT), at the cost of slightly
|
|
|
bdc76f |
+increased program load times.
|
|
|
bdc76f |
|
|
|
bdc76f |
@pindex pt_chown
|
|
|
bdc76f |
@findex grantpt
|