Bug 1387475 (RHEL-hardening-cflags)

In terms of testing that the right things happened in the build system, we have to examine the elf flags of the resulting ELF files. Something along the lines of this would give you the flags:

#!/bin/sh

if [ $# -ne 1 ] ; then
  echo "You need to pass a file"
  exit 1
fi

/usr/bin/file $1 | grep 'ELF' >/dev/null 2>&1
if [ $? -ne 0 ] ; then
  echo "Not an ELF file"
  exit 1
fi

# Check PIE flags
if readelf -h $1 2>/dev/null | grep -q 'Type:[[:space:]]*EXEC'; then
  echo 'No PIE'
elif readelf -h $1 2>/dev/null | grep -q 'Type:[[:space:]]*DYN'; then
  if readelf -d $1 2>/dev/null | grep -q '(DEBUG)'; then
    echo 'PIE enabled'
  else
    echo 'Dynamic Shared Object'
  fi
fi

# Check RELRO flags
if readelf -l $1 2>/dev/null | grep -q 'GNU_RELRO'; then
  if readelf -d $1 2>/dev/null | grep -q 'BIND_NOW'; then
    echo 'Full RELRO'
  else
    echo 'Partial RELRO'
  fi
else
  echo 'No RELRO'
fi

You want either PIE Enabled or Dynamic Shared Object for the first line, and Full RELRO for the second line.

Looking at the rhel7 file, we have this:
%_hardened_build        0

That should be changed to a 1. There is also some macro and script associated with %_configure_libtool_hardening_hack. I presume that should also be added. There's not much in the way of documenting what problem it solves. Also,
/usr/lib/rpm/redhat/redhat-hardened-cc1 and /usr/lib/rpm/redhat/redhat-hardened-ld are both slightly different. Again not much in the way of documenting why they were changed.