From 658fff9445711b8402029bc2916fccbc5d6fd8fc Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Jan=20Pokorn=C3=BD?= <jpokorny@redhat.com>

Date: Tue, 21 Jun 2016 19:16:43 +0200

Subject: [PATCH 1/2] Feature: conditional hardening, especially for daemons +

 libraries

So far the build system has not been concerned with run-time hardening

measures the typical toolchains provide (beside unconditional enforcing

of -fstack-protector-all).  Hence make a step in that direction,

enabling following if available and anticipating more to come:

[$LD -z relro]

- daemons incl. libs

- make some parts of Global Offset Table (GOT) read-only

[$CC -fPIE + ld -pie]

- daemons

- benefit from Address Space Layout Randomization (ASLR) for code

  areas

[$LD -z now]

- daemons incl. libs, only when the former two features are supported

- all symbols are resolved initially to that complete GOT is read-only

[$CC -fstack-protector-strong/-fstack-protector-all/-fstack-protector]

- universal

- extra run-time checks for buffer overflows

- NOTE:

  in case -fstack-protector-strong is supported, this is effectively

  a weakening of previously enforced -fstack-protector-all, but note

  that this variant comes with not entirely negligible performance

  penalty [1], making "strong" variant a reasonable tradeoff for

  something that is not in the prime line of possible attacks

For details on how to instruct configure script to do the right

thing (for when the default won't cut it), see detailed comment

in configure.ac under "Hardening flags" section.

[1] http://nvlpubs.nist.gov/nistpubs/TechnicalNotes/NIST.TN.1860.pdf

---

 acinclude.m4               |  25 +++++++++

 attrd/Makefile.am          |   3 +

 cib/Makefile.am            |   3 +

 configure.ac               | 135 +++++++++++++++++++++++++++++++++++++++++++--

 crmd/Makefile.am           |   3 +

 fencing/Makefile.am        |   3 +

 lib/cib/Makefile.am        |   3 +

 lib/cluster/Makefile.am    |   4 ++

 lib/common/Makefile.am     |   4 ++

 lib/fencing/Makefile.am    |   4 ++

 lib/lrmd/Makefile.am       |   4 ++

 lib/pengine/Makefile.am    |   8 +++

 lib/services/Makefile.am   |   3 +

 lib/transition/Makefile.am |   3 +

 lrmd/Makefile.am           |   6 ++

 mcp/Makefile.am            |   3 +

 pacemaker.spec.in          |  17 ++++++

 pengine/Makefile.am        |   6 ++

 18 files changed, 231 insertions(+), 6 deletions(-)

 create mode 100644 acinclude.m4

diff --git a/acinclude.m4 b/acinclude.m4

new file mode 100644

index 0000000..ecaa1dd

--- /dev/null

+++ b/acinclude.m4

@@ -0,0 +1,25 @@

+dnl

+dnl local autoconf/automake macros for pacemaker

+dnl

+

+dnl Check if the flag is supported by linker (cacheable)

+dnl CC_CHECK_LDFLAGS([FLAG], [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND])

+dnl

+dnl Origin (declared license: GPLv2+ with less restrictive exception):

+dnl https://git.gnome.org/browse/glib/tree/m4macros/attributes.m4?h=2.49.1

+dnl (AC_LANG_PROGRAM substituted by Jan Pokorny <jpokorny@redhat.com>)

+

+AC_DEFUN([CC_CHECK_LDFLAGS], [

+  AC_CACHE_CHECK([if $CC supports $1 flag],

+    AS_TR_SH([cc_cv_ldflags_$1]),

+    [ac_save_LDFLAGS="$LDFLAGS"

+     LDFLAGS="$LDFLAGS $1"

+     AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],

+       [eval "AS_TR_SH([cc_cv_ldflags_$1])='yes'"],

+       [eval "AS_TR_SH([cc_cv_ldflags_$1])="])

+     LDFLAGS="$ac_save_LDFLAGS"

+    ])

+

+  AS_IF([eval test x$]AS_TR_SH([cc_cv_ldflags_$1])[ = xyes],

+    [$2], [$3])

+])

diff --git a/attrd/Makefile.am b/attrd/Makefile.am

index a116e0e..6eaaae2 100644

--- a/attrd/Makefile.am

+++ b/attrd/Makefile.am

@@ -21,6 +21,9 @@ halibdir	= $(CRM_DAEMON_DIR)

 halib_PROGRAMS	= attrd

 ## SOURCES

+attrd_CFLAGS	= $(CFLAGS_HARDENED_EXE)

+attrd_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

+

 attrd_LDADD	= $(top_builddir)/lib/cluster/libcrmcluster.la	\

 		$(top_builddir)/lib/common/libcrmcommon.la	\

 		$(top_builddir)/lib/cib/libcib.la		\

diff --git a/cib/Makefile.am b/cib/Makefile.am

index fcb8ce9..4273191 100644

--- a/cib/Makefile.am

+++ b/cib/Makefile.am

@@ -32,6 +32,9 @@ halib_PROGRAMS	= cib cibmon

 ## SOURCES

 noinst_HEADERS	= callbacks.h cibio.h cibmessages.h common.h notify.h

+cib_CFLAGS	= $(CFLAGS_HARDENED_EXE)

+cib_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

+

 cib_LDADD	= $(top_builddir)/lib/cluster/libcrmcluster.la \

 		$(COMMONLIBS) $(CRYPTOLIB) $(CLUSTERLIBS)

diff --git a/configure.ac b/configure.ac

index c5b30dc..edf6a91 100644

--- a/configure.ac

+++ b/configure.ac

@@ -196,6 +196,13 @@ AC_ARG_ENABLE([systemd],

     [  --enable-systemd

        Do not build support for the Systemd init system [default=yes]])

+AC_ARG_ENABLE(hardening,

+    [  --with-hardening

+       Harden the resulting executables/libraries (best effort by default)],

+    [ HARDENING="${enableval}" ],

+    [ HARDENING=try ],

+)

+

 AC_ARG_WITH(ais,

     [  --with-ais

        Support the Corosync messaging and membership layer ],

@@ -1710,6 +1717,12 @@ if export | fgrep " CFLAGS=" > /dev/null; then

 	unset SAVED_CFLAGS

 fi

+AC_ARG_VAR([CFLAGS_HARDENED_LIB], [extra C compiler flags for hardened libraries])

+AC_ARG_VAR([LDFLAGS_HARDENED_LIB], [extra linker flags for hardened libraries])

+

+AC_ARG_VAR([CFLAGS_HARDENED_EXE], [extra C compiler flags for hardened executables])

+AC_ARG_VAR([LDFLAGS_HARDENED_EXE], [extra linker flags for hardened executables])

+

 CC_EXTRAS=""

 if test "$GCC" != yes; then

@@ -1785,12 +1798,6 @@ dnl otherwise none of both

 # Additional warnings it might be nice to enable one day

 #		-Wshadow

 #		-Wunreachable-code

-	case "$host_os" in

-	    *solaris*) ;;

-	    *) EXTRA_FLAGS="$EXTRA_FLAGS

-			-fstack-protector-all"

-		;;

-	esac

 	for j in $EXTRA_FLAGS

 	do

 	  if

@@ -1829,6 +1836,118 @@ dnl System specific options

   	AC_MSG_NOTICE(Activated additional gcc flags: ${CC_EXTRAS})

 fi

+dnl

+dnl Hardening flags

+dnl

+dnl The prime control of whether to apply (targeted) hardening build flags and

+dnl which ones is --{enable,disable}-hardening option passed to ./configure:

+dnl

+dnl --enable-hardening=try (default):

+dnl     depending on whether any of CFLAGS_HARDENED_EXE, LDFLAGS_HARDENED_EXE,

+dnl     CFLAGS_HARDENED_LIB or LDFLAGS_HARDENED_LIB environment variables

+dnl     (see below) is set and non-null, all these custom flags (even if not

+dnl     set) are used as are, otherwise the best effort is made to offer

+dnl     reasonably strong hardening in several categories (RELRO, PIE,

+dnl     "bind now", stack protector) according to what the selected toolchain

+dnl     can offer

+dnl

+dnl --enable-hardening:

+dnl     same effect as --enable-hardening=try when the environment variables

+dnl     in question are suppressed

+dnl

+dnl --disable-hardening:

+dnl     do not apply any targeted hardening measures at all

+dnl

+dnl The user-injected environment variables that regulate the hardening in

+dnl default case are as follows:

+dnl

+dnl * CFLAGS_HARDENED_EXE, LDFLAGS_HARDENED_EXE

+dnl    compiler and linker flags (respectively) for daemon programs

+dnl    (attrd, cib, crmd, lrmd, stonithd, pacemakerd, pacemaker_remoted,

+dnl    pengine)

+dnl

+dnl * CFLAGS_HARDENED_LIB, LDFLAGS_HARDENED_LIB

+dnl    compiler and linker flags (respectively) for libraries linked

+dnl    with the daemon programs

+dnl

+dnl Note that these are purposedly targeted variables (addressing particular

+dnl targets all over the scattered Makefiles) and have no effect outside of

+dnl the predestined scope (e.g., CLI utilities).  For a global reach,

+dnl use CFLAGS, LDFLAGS, etc. as usual.

+dnl

+dnl For guidance on the suitable flags consult, for instance:

+dnl https://fedoraproject.org/wiki/Changes/Harden_All_Packages#Detailed_Harden_Flags_Description

+dnl https://owasp.org/index.php/C-Based_Toolchain_Hardening#GCC.2FBinutils

+dnl

+

+if test "x${HARDENING}" != "xtry"; then

+	unset CFLAGS_HARDENED_EXE

+	unset CFLAGS_HARDENED_LIB

+	unset LDFLAGS_HARDENED_EXE

+	unset LDFLAGS_HARDENED_LIB

+fi

+if test "x${HARDENING}" = "xno"; then

+	AC_MSG_NOTICE([Hardening: explicitly disabled])

+elif test "x${HARDENING}" = "xyes" \

+    || test "$(env | grep -Ec '^(C|LD)FLAGS_HARDENED_(EXE|LIB)=.')" = 0; then

+	dnl We'll figure out on our own...

+	CFLAGS_HARDENED_EXE=

+	CFLAGS_HARDENED_LIB=

+	LDFLAGS_HARDENED_EXE=

+	LDFLAGS_HARDENED_LIB=

+	relro=0

+	pie=0

+	bindnow=0

+	# daemons incl. libs: partial RELRO

+	flag="-Wl,-z,relro"

+	CC_CHECK_LDFLAGS(["${flag}"],

+		[LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}";

+		 LDFLAGS_HARDENED_LIB="${LDFLAGS_HARDENED_LIB} ${flag}";

+		 relro=1]

+	)

+	# daemons: PIE for both CFLAGS and LDFLAGS

+	if cc_supports_flag -fPIE; then

+		flag="-pie"

+		CC_CHECK_LDFLAGS(["${flag}"],

+			[CFLAGS_HARDENED_EXE="${CFLAGS_HARDENED_EXE} -fPIE";

+			 LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}";

+			 pie=1]

+		)

+	fi

+	# daemons incl. libs: full RELRO if sensible

+	if test "${relro}" = 1 && test "${pie}" = 1; then

+		flag="-Wl,-z,now"

+		CC_CHECK_LDFLAGS(["${flag}"],

+			[LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}";

+			 LDFLAGS_HARDENED_LIB="${LDFLAGS_HARDENED_LIB} ${flag}";

+			 bindnow=1]

+		)

+	fi

+	# universal: prefer strong > all > default stack protector if possible

+	flag=

+	if cc_supports_flag -fstack-protector-strong; then

+		flag="-fstack-protector-strong"

+	elif cc_supports_flag -fstack-protector-all; then

+		flag="-fstack-protector-all"

+	elif cc_supports_flag -fstack-protector; then

+		flag="-fstack-protector"

+	fi

+	if test -n "${flag}"; then

+		CC_EXTRAS="${CC_EXTRAS} ${flag}"

+		stackprot=1

+	fi

+	if test "${relro}" = 1 \

+	|| test "${pie}" = 1 \

+	|| test "${stackprot}" = 1; then

+		AC_MSG_NOTICE(

+		[Hardening: relro=${relro} pie=${pie} bindnow=${bindnow} stackprot=${flag}])

+	else

+		AC_MSG_WARN([Hardening: no suitable features in the toolchain detected])

+	fi

+else

+	AC_MSG_NOTICE([Hardening: using custom flags])

+fi

+

 CFLAGS="$CFLAGS $CC_EXTRAS"

 NON_FATAL_CFLAGS="$CFLAGS"

@@ -1978,5 +2097,9 @@ AC_MSG_RESULT([  HA group name            = ${CRM_DAEMON_GROUP}])

 AC_MSG_RESULT([  HA user name             = ${CRM_DAEMON_USER}])

 AC_MSG_RESULT([])

 AC_MSG_RESULT([  CFLAGS                   = ${CFLAGS}])

+AC_MSG_RESULT([  CFLAGS_HARDENED_EXE      = ${CFLAGS_HARDENED_EXE}])

+AC_MSG_RESULT([  CFLAGS_HARDENED_LIB      = ${CFLAGS_HARDENED_LIB}])

+AC_MSG_RESULT([  LDFLAGS_HARDENED_EXE     = ${LDFLAGS_HARDENED_EXE}])

+AC_MSG_RESULT([  LDFLAGS_HARDENED_LIB     = ${LDFLAGS_HARDENED_LIB}])

 AC_MSG_RESULT([  Libraries                = ${LIBS}])

 AC_MSG_RESULT([  Stack Libraries          = ${CLUSTERLIBS}])

diff --git a/crmd/Makefile.am b/crmd/Makefile.am

index 979e266..6d5ee9a 100644

--- a/crmd/Makefile.am

+++ b/crmd/Makefile.am

@@ -28,6 +28,9 @@ noinst_HEADERS	= crmd.h crmd_fsa.h crmd_messages.h fsa_defines.h	\

 		fsa_matrix.h fsa_proto.h crmd_utils.h crmd_callbacks.h	\

 		crmd_lrm.h te_callbacks.h tengine.h

+crmd_CFLAGS	= $(CFLAGS_HARDENED_EXE)

+crmd_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

+

 crmd_LDADD	= $(top_builddir)/lib/fencing/libstonithd.la		\

 		$(top_builddir)/lib/transition/libtransitioner.la	\

 		$(top_builddir)/lib/pengine/libpe_rules.la		\

diff --git a/fencing/Makefile.am b/fencing/Makefile.am

index 1d591fc..c53ead6 100644

--- a/fencing/Makefile.am

+++ b/fencing/Makefile.am

@@ -52,6 +52,9 @@ stonith_admin_LDADD	= $(top_builddir)/lib/common/libcrmcommon.la	\

 stonithd_CPPFLAGS	= -I$(top_srcdir)/pengine $(AM_CPPFLAGS)

 stonithd_YFLAGS		= -d

+stonithd_CFLAGS		= $(CFLAGS_HARDENED_EXE)

+stonithd_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

+

 stonithd_LDADD		= $(top_builddir)/lib/common/libcrmcommon.la	\

 			$(top_builddir)/lib/cluster/libcrmcluster.la	\

 			$(top_builddir)/lib/fencing/libstonithd.la	\

diff --git a/lib/cib/Makefile.am b/lib/cib/Makefile.am

index e414a7f..637ea8c 100644

--- a/lib/cib/Makefile.am

+++ b/lib/cib/Makefile.am

@@ -27,6 +27,9 @@ libcib_la_SOURCES	+= cib_file.c cib_remote.c

 libcib_la_LDFLAGS	= -version-info 5:1:1

 libcib_la_CPPFLAGS	= -I$(top_srcdir) $(AM_CPPFLAGS)

+libcib_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libcib_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libcib_la_LIBADD	= $(CRYPTOLIB) $(top_builddir)/lib/pengine/libpe_rules.la $(top_builddir)/lib/common/libcrmcommon.la

 clean-generic:

diff --git a/lib/cluster/Makefile.am b/lib/cluster/Makefile.am

index 06d7066..9a57bbb 100644

--- a/lib/cluster/Makefile.am

+++ b/lib/cluster/Makefile.am

@@ -21,6 +21,10 @@ include $(top_srcdir)/Makefile.common

 lib_LTLIBRARIES	= libcrmcluster.la 

 libcrmcluster_la_LDFLAGS = -version-info 6:0:2

+

+libcrmcluster_la_CFLAGS  = $(CFLAGS_HARDENED_LIB)

+libcrmcluster_la_LDFLAGS += $(LDFLAGS_HARDENED_LIB)

+

 libcrmcluster_la_LIBADD  = $(top_builddir)/lib/common/libcrmcommon.la $(top_builddir)/lib/fencing/libstonithd.la $(CLUSTERLIBS)

 libcrmcluster_la_SOURCES = election.c cluster.c membership.c

diff --git a/lib/common/Makefile.am b/lib/common/Makefile.am

index 7550ec1..0e1ad29 100644

--- a/lib/common/Makefile.am

+++ b/lib/common/Makefile.am

@@ -32,6 +32,10 @@ lib_LTLIBRARIES	= libcrmcommon.la

 CFLAGS		= $(CFLAGS_COPY:-Wcast-qual=) -fPIC

 libcrmcommon_la_LDFLAGS	= -version-info 9:0:6

+

+libcrmcommon_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libcrmcommon_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libcrmcommon_la_LIBADD	= @LIBADD_DL@ $(GNUTLSLIBS) -lm

 libcrmcommon_la_SOURCES	= compat.c digest.c ipc.c io.c procfs.c utils.c xml.c \

diff --git a/lib/fencing/Makefile.am b/lib/fencing/Makefile.am

index 85ae40a..dc15799 100644

--- a/lib/fencing/Makefile.am

+++ b/lib/fencing/Makefile.am

@@ -21,5 +21,9 @@ include $(top_srcdir)/Makefile.common

 lib_LTLIBRARIES		= libstonithd.la

 libstonithd_la_LDFLAGS	= -version-info 4:1:2

+

+libstonithd_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libstonithd_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libstonithd_la_LIBADD	= $(top_builddir)/lib/common/libcrmcommon.la

 libstonithd_la_SOURCES	= st_client.c

diff --git a/lib/lrmd/Makefile.am b/lib/lrmd/Makefile.am

index 25f3d55..611675e 100644

--- a/lib/lrmd/Makefile.am

+++ b/lib/lrmd/Makefile.am

@@ -19,6 +19,10 @@ include $(top_srcdir)/Makefile.common

 lib_LTLIBRARIES		= liblrmd.la

 liblrmd_la_LDFLAGS	= -version-info 4:0:3

+

+liblrmd_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+liblrmd_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 liblrmd_la_LIBADD	= $(top_builddir)/lib/common/libcrmcommon.la	\

 			$(top_builddir)/lib/services/libcrmservice.la	\

 			$(top_builddir)/lib/fencing/libstonithd.la

diff --git a/lib/pengine/Makefile.am b/lib/pengine/Makefile.am

index de760c3..ad5c5c3 100644

--- a/lib/pengine/Makefile.am

+++ b/lib/pengine/Makefile.am

@@ -24,10 +24,18 @@ lib_LTLIBRARIES		= libpe_rules.la libpe_status.la

 noinst_HEADERS		= unpack.h variant.h

 libpe_rules_la_LDFLAGS	= -version-info 2:6:0

+

+libpe_rules_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libpe_rules_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libpe_rules_la_LIBADD	= $(top_builddir)/lib/common/libcrmcommon.la

 libpe_rules_la_SOURCES	= rules.c common.c

 libpe_status_la_LDFLAGS	= -version-info 11:0:1

+

+libpe_status_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libpe_status_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libpe_status_la_LIBADD	= @CURSESLIBS@ $(top_builddir)/lib/common/libcrmcommon.la

 libpe_status_la_SOURCES	= status.c unpack.c utils.c complex.c native.c \

 			group.c clone.c rules.c common.c remote.c

diff --git a/lib/services/Makefile.am b/lib/services/Makefile.am

index c789fbd..b3208c2 100644

--- a/lib/services/Makefile.am

+++ b/lib/services/Makefile.am

@@ -27,6 +27,9 @@ libcrmservice_la_LDFLAGS	= -version-info 4:1:1

 libcrmservice_la_CPPFLAGS	= -DOCF_ROOT_DIR=\"@OCF_ROOT_DIR@\" $(AM_CPPFLAGS)

 libcrmservice_la_CFLAGS		= $(GIO_CFLAGS)

+libcrmservice_la_CFLAGS		+= $(CFLAGS_HARDENED_LIB)

+libcrmservice_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libcrmservice_la_LIBADD		= $(GIO_LIBS) $(top_builddir)/lib/common/libcrmcommon.la $(DBUS_LIBS)

 libcrmservice_la_SOURCES	= services.c services_linux.c

diff --git a/lib/transition/Makefile.am b/lib/transition/Makefile.am

index 9bc039e..4d6cd23 100644

--- a/lib/transition/Makefile.am

+++ b/lib/transition/Makefile.am

@@ -25,6 +25,9 @@ lib_LTLIBRARIES			= libtransitioner.la

 libtransitioner_la_LDFLAGS	= -version-info 2:5:0

 libtransitioner_la_CPPFLAGS	= -I$(top_builddir) $(AM_CPPFLAGS)

+libtransitioner_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libtransitioner_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libtransitioner_la_LIBADD	= $(top_builddir)/lib/common/libcrmcommon.la

 libtransitioner_la_SOURCES	= unpack.c graph.c utils.c

diff --git a/lrmd/Makefile.am b/lrmd/Makefile.am

index 64df105..5846503 100644

--- a/lrmd/Makefile.am

+++ b/lrmd/Makefile.am

@@ -30,6 +30,9 @@ if BUILD_SYSTEMD

 systemdunit_DATA	= pacemaker_remote.service

 endif

+lrmd_CFLAGS		= $(CFLAGS_HARDENED_EXE)

+lrmd_LDFLAGS		= $(LDFLAGS_HARDENED_EXE)

+

 lrmd_LDADD		= $(top_builddir)/lib/common/libcrmcommon.la	\

 			$(top_builddir)/lib/services/libcrmservice.la	\

 			$(top_builddir)/lib/lrmd/liblrmd.la		\

@@ -38,6 +41,9 @@ lrmd_SOURCES		= main.c lrmd.c

 pacemaker_remoted_CPPFLAGS	= -DSUPPORT_REMOTE $(AM_CPPFLAGS)

+pacemaker_remoted_CFLAGS	= $(CFLAGS_HARDENED_EXE)

+pacemaker_remoted_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

+

 pacemaker_remoted_LDADD		= $(lrmd_LDADD)

 pacemaker_remoted_SOURCES	= main.c lrmd.c tls_backend.c ipc_proxy.c

diff --git a/mcp/Makefile.am b/mcp/Makefile.am

index 195530a..074d251 100644

--- a/mcp/Makefile.am

+++ b/mcp/Makefile.am

@@ -31,6 +31,9 @@ endif

 noinst_HEADERS		= pacemaker.h

+pacemakerd_CFLAGS	= $(CFLAGS_HARDENED_EXE)

+pacemakerd_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

+

 pacemakerd_LDADD	= $(top_builddir)/lib/cluster/libcrmcluster.la $(top_builddir)/lib/common/libcrmcommon.la

 pacemakerd_LDADD	+= $(CLUSTERLIBS)

 pacemakerd_SOURCES	= pacemaker.c corosync.c

diff --git a/pacemaker.spec.in b/pacemaker.spec.in

index 6024514..a607588 100644

--- a/pacemaker.spec.in

+++ b/pacemaker.spec.in

@@ -63,6 +63,9 @@

 # Turn off cman support on platforms that normally ship with it

 %bcond_without cman

+# Turn off hardening of libraries and daemon executables

+%bcond_without hardening

+

 %if %{with profiling}

 # This disables -debuginfo package creation and also the stripping binaries/libraries

 # Useful if you want sane profiling data

@@ -168,6 +171,7 @@ resource health.

 Available rpmbuild rebuild options:

   --with(out) : cman stonithd doc coverage profiling pre_release upstart_job

+                hardening

 %package cli

 License:       GPLv2+ and LGPLv2+

@@ -301,6 +305,18 @@ find . -exec touch \{\} \;

 # Early versions of autotools (e.g. RHEL <= 5) do not support --docdir

 export docdir=%{pcmk_docdir}

+%if %{with hardening}

+# prefer distro-provided hardening flags in case they are defined

+# through _hardening_{c,ld}flags macros, configure script will

+# use its own defaults otherwise; if such hardenings are completely

+# undesired, rpmbuild using "--without hardening"

+# (or "--define '_without_hardening 1'")

+export CFLAGS_HARDENED_EXE="%{?_hardening_cflags}"

+export CFLAGS_HARDENED_LIB="%{?_hardening_cflags}"

+export LDFLAGS_HARDENED_EXE="%{?_hardening_ldflags}"

+export LDFLAGS_HARDENED_LIB="%{?_hardening_ldflags}"

+%endif

+

 ./autogen.sh

 %{configure}                                       \

@@ -309,6 +325,7 @@ export docdir=%{pcmk_docdir}

         %{!?with_cman:       --without-cman}       \

         --without-heartbeat                        \

         %{!?with_doc:        --with-brand=}        \

+        %{!?with_hardening:  --disable-hardening}  \

         --with-initdir=%{_initrddir}               \

         --localstatedir=%{_var}                    \

         --with-version=%{version}-%{release}

diff --git a/pengine/Makefile.am b/pengine/Makefile.am

index 96c914f..d4dbfb9 100644

--- a/pengine/Makefile.am

+++ b/pengine/Makefile.am

@@ -61,12 +61,18 @@ endif

 noinst_HEADERS	= allocate.h utils.h pengine.h

 libpengine_la_LDFLAGS	= -version-info 11:0:1

+

+libpengine_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)

+libpengine_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)

+

 libpengine_la_LIBADD	= $(top_builddir)/lib/pengine/libpe_status.la \

 			$(top_builddir)/lib/cib/libcib.la

 # -L$(top_builddir)/lib/pils -lpils -export-dynamic -module -avoid-version

 libpengine_la_SOURCES	= pengine.c allocate.c utils.c constraints.c

 libpengine_la_SOURCES	+= native.c group.c clone.c master.c graph.c utilization.c

+pengine_CFLAGS	= $(CFLAGS_HARDENED_EXE)

+pengine_LDFLAGS	= $(LDFLAGS_HARDENED_EXE)

 pengine_LDADD	= $(top_builddir)/lib/cib/libcib.la $(COMMONLIBS)

 # libcib for get_object_root()

 #		$(top_builddir)/lib/hbclient/libhbclient.la

-- 

1.8.3.1

From 35ec27112452f2bd06ae8b395d8543db935e2b05 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Jan=20Pokorn=C3=BD?= <jpokorny@redhat.com>

Date: Wed, 22 Jun 2016 15:18:00 +0200

Subject: [PATCH 2/2] Build: configure.ac: prefer as-needed linking in case of

 "-z now"

Slight optimization of a default toolchain-flags-based hardening.

---

 configure.ac | 12 +++++++++++-

 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac

index edf6a91..4beb877 100644

--- a/configure.ac

+++ b/configure.ac

@@ -1914,7 +1914,10 @@ elif test "x${HARDENING}" = "xyes" \

 			 pie=1]

 		)

 	fi

-	# daemons incl. libs: full RELRO if sensible

+	# daemons incl. libs: full RELRO if sensible + as-needed linking

+	#                     so as to possibly mitigate startup performance

+	#                     hit caused by excessive linking with unneeded

+	#                     libraries

 	if test "${relro}" = 1 && test "${pie}" = 1; then

 		flag="-Wl,-z,now"

 		CC_CHECK_LDFLAGS(["${flag}"],

@@ -1923,6 +1926,13 @@ elif test "x${HARDENING}" = "xyes" \

 			 bindnow=1]

 		)

 	fi

+	if test "${bindnow}" = 1; then

+		flag="-Wl,--as-needed"

+		CC_CHECK_LDFLAGS(["${flag}"],

+			[LDFLAGS_HARDENED_EXE="${LDFLAGS_HARDENED_EXE} ${flag}";

+			 LDFLAGS_HARDENED_LIB="${LDFLAGS_HARDENED_LIB} ${flag}"]

+		)

+	fi

 	# universal: prefer strong > all > default stack protector if possible

 	flag=

 	if cc_supports_flag -fstack-protector-strong; then

-- 

1.8.3.1