Bug 1541033

Summary:	openssl: Incomplete RPM build flags injection
Product:	[Fedora] Fedora	Reporter:	Florian Weimer <fweimer>
Component:	openssl	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	jorton, tmraz
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-1.1.0g-6.fc28	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-23 16:42:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1539083

Description Florian Weimer 2018-02-01 14:54:57 UTC

In openssl-1.1.0g-3.fc28, /usr/bin/openssl has e_type ET_EXEC, so it is not a PIE executable.  This means that the RPM build flags injection was incomplete, and the preferred LDFLAGS setting is not used.  (Currently, linker flags are available via $RPM_LD_FLAGS.)

Comment 1 Florian Weimer 2018-02-23 14:01:29 UTC

The issue is still present in openssl-libs-1:1.1.0g-5.fc28.x86_64:

# checksec --file /usr/lib64/libcrypto.so.1.1.0g
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    DSO             No RPATH   No RUNPATH   Yes     8               21      /usr/lib64/libcrypto.so.1.1.0g