Bug 1558516
| Summary: | ksmctl is built without any hardening flags set [rhel-7.6] | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Daniel Berrangé <berrange> | |
| Component: | qemu-kvm-rhev | Assignee: | Miroslav Rezanina <mrezanin> | |
| Status: | CLOSED ERRATA | QA Contact: | Chao Yang <chayang> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.5 | CC: | chayang, fweimer, jen, juzhang, knoel, michen, mrezanin, virt-maint | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | qemu-kvm-rhev-2.12.0-3.el7 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1558520 1558895 (view as bug list) | Environment: | ||
| Last Closed: | 2018-11-01 11:07:15 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1558895 | |||
If needed, please clone for qemu-kvm-ma. Fix included in qemu-kvm-rhev-2.12.0-3.el7 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3443 |
Description of problem: The Red Hat distro RPM config defines various hardening flags that all binaries in RHEL should be built with # rpmbuild --eval '%{optflags}' -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic # rpmbuild --eval '%{__global_ldflags}' -Wl,-z,relro The ksmctl binary is being built without honouring these flags: eg the qemu-kvm.spec just runs: gcc %{SOURCE6} -O2 -g -o ksmctl This needs to be made to honour the hardenin flags by using gcc %{SOURCE6} $RPM_OPT_FLAGS $RPM_LD_FLAGS -o ksmctl Also note that earlier in the specfile, it cull FORTIFY_SOURCE=2 from the %{optflags}: # QEMU already knows how to set _FORTIFY_SOURCE %global optflags %(echo %{optflags} | sed 's/-Wp,-D_FORTIFY_SOURCE=2//') this needs to be removed, so that the ksm build still sees _FORTIFY_SOURCE Version-Release number of selected component (if applicable): qemu-kvm-rhev-2.10.0-21.el7