Bug 1236456

Summary: Koji build add extra cflags automaticlly like -fexceptions -fstack-protector-strong
Product: [Fedora] Fedora Reporter: Dave Young <ruyang>
Component: kexec-toolsAssignee: Dave Young <ruyang>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: rawhideCC: bhe, dennis, kdump-team-bugs, mikem, mtasaka, panand, pbrobinson, ruyang, wcwxyz
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1236466 (view as bug list) Environment:
Last Closed: 2015-07-02 02:40:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1236466    

Description Dave Young 2015-06-29 06:06:47 UTC
Description of problem:

Koji build kexec-tools in rawhide create a wrong binary with extra cflags. Local build is ok.

> We updated Fedora kexec-tools to 2.0.9, plan to move to 2.0.10 soon.
>
> But I see below error:
> R_X86_64_29
> Unhandled rela relocation: R_X86_64_29
> 
> There was a similar report before:
> http://lists.infradead.org/pipermail/kexec/2015-February/013305.html
> 
> The strange thing is local build works for me, but koji build server
> build does not work. 2.0.10 koji build also fails to load.
>

It should be koji build system problem, I found it adds -fexceptions and
-fstack-protetor-strong, the cmdline is like below (copied from a test build log):

gcc -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong
--param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic
-fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -mcmodel=small -Os -fno-builtin -ffreestanding
-fno-zero-initialized-in-bss -fno-PIC -fno-PIE -fno-stack-protector -fno-exceptions -fno-asynchronous-unwind-tables
-mcmodel=small -I./purgatory/include -I./purgatory/arch/x86_64/include -I./util_lib/include -I./include -Iinclude
-I/usr/lib/gcc/x86_64-redhat-linux/5.1.1/include  -c -MD -o purgatory/purgatory.o purgatory/purgatory.c

(-mcmodel=small is added by me for testing it does not help)

Comment 1 Dave Young 2015-06-29 06:11:17 UTC
Explain a bit about purgatory build, purgatory is some code which is run in kernel space during kexec loading so some flags does not work for it like -fexceptions -fstack-protector** etc.

Comment 2 Mamoru TASAKA 2015-07-01 02:47:28 UTC
Do you properly have installed "redhat-rpm-config" rpm installed
when trying local build? koji build (or mock build) always make
this rpm installed, and it changes %optflags (or it is recommended
to install "fedora-packager" rpm when trying local build).

Try installing "redhat-rpm-config" rpm if not installed and then
try what
$ rpm --eval %optflags
shows.

Comment 3 Baoquan He 2015-07-01 07:36:30 UTC
Hi,

On my laptop, the command executed output below results:

➜  kexec-tools git:(master) ✗ rpm --eval %optflags
-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches  -m64 -mtune=generic

Thanks
Baoquan

Comment 4 Peter Robinson 2015-07-01 08:08:07 UTC
If you add the following line to the top of the rpm spec file it will remove all the extra hardening flags and take you back to the F-22 equivilent

%undefine _hardened_build

Comment 5 Dave Young 2015-07-02 02:29:06 UTC
(In reply to Peter Robinson from comment #4)
> If you add the following line to the top of the rpm spec file it will remove
> all the extra hardening flags and take you back to the F-22 equivilent
> 
> %undefine _hardened_build

Peter, thanks a lot, it works for me.

Dave

Comment 6 Peter Robinson 2015-07-02 13:00:16 UTC
Just for clarification here:

kexec-tools-2.0.9-2.fc23
------------------------
* Thu Jul 02 2015 Dave Young <dyoung> - 2.0.9-2
- Resolve bug 1236456, kexec load fail because koji add extra gcc flags.
- Remove -FPIC for makedumpfile since it is not necessary without harden build

koji doesn't do anything with gcc flags what so ever, they are added by rpmbuild when the redhat-rpm-config package is installed. This is part of the build root core packages. You can install it on local machines and the same will happen when using rpmbuild locally or within mock.

Comment 7 Dave Young 2015-07-03 06:30:46 UTC
(In reply to Peter Robinson from comment #6)
> Just for clarification here:
> 
> kexec-tools-2.0.9-2.fc23
> ------------------------
> * Thu Jul 02 2015 Dave Young <dyoung> - 2.0.9-2
> - Resolve bug 1236456, kexec load fail because koji add extra gcc flags.
> - Remove -FPIC for makedumpfile since it is not necessary without harden
> build
> 
> koji doesn't do anything with gcc flags what so ever, they are added by
> rpmbuild when the redhat-rpm-config package is installed. This is part of
> the build root core packages. You can install it on local machines and the
> same will happen when using rpmbuild locally or within mock.

I checked local rpmbuild gcc flags, they are exactly same with koji used, but it is odd local build works, koji build does not.