In packages built from php-7.2.2-1.fc28, many shared objects were not linked with the usual Fedora linker flags from redhat-rpm-config. For example, /usr/lib64/php/modules/ctype.so was not linked with -z now -z relro. It seems that LDFLAGS injection did not work for some reason. The linker flags from redhat-rpm-config are available in the $RPM_LD_FLAGS shell variable from within the %build section in the RPM spec file.
I need to understand the issue... From build.log /bin/sh /builddir/build/BUILD/php-7.2.2/build-cgi/libtool --silent --preserve-dup-deps --mode=link cc -DPHP_ATOM_INC -I/builddir/build/BUILD/php-7.2.2/build-cgi/include -I/builddir/build/BUILD/php-7.2.2/build-cgi/main -I/builddir/build/BUILD/php-7.2.2 -I/builddir/build/BUILD/php-7.2.2/build-cgi/ext/date/lib -I/builddir/build/BUILD/php-7.2.2/ext/date/lib -I/usr/include/libxml2 -I/usr/include/enchant -I/usr/X11 -I/usr/include/freetype2 -I/usr/include/libpng16 -I/usr/include/imap -I/usr/include/firebird -I/builddir/build/BUILD/php-7.2.2/ext/mbstring/libmbfl -I/builddir/build/BUILD/php-7.2.2/build-cgi/ext/mbstring/libmbfl -I/builddir/build/BUILD/php-7.2.2/ext/mbstring/libmbfl/mbfl -I/builddir/build/BUILD/php-7.2.2/build-cgi/ext/mbstring/libmbfl/mbfl -I/usr/include/pspell -I/builddir/build/BUILD/php-7.2.2/build-cgi/TSRM -I/builddir/build/BUILD/php-7.2.2/build-cgi/Zend -I/builddir/build/BUILD/php-7.2.2/main -I/builddir/build/BUILD/php-7.2.2/Zend -I/builddir/build/BUILD/php-7.2.2/TSRM -I/builddir/build/BUILD/php-7.2.2/build-cgi/ -I/usr/include -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -mcet -fcf-protection -fno-strict-aliasing -Wno-pointer-sign -fvisibility=hidden -DZEND_SIGNALS -Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -o ext/ctype/ctype.la -export-dynamic -avoid-version -prefer-pic -module -rpath /builddir/build/BUILD/php-7.2.2/build-cgi/modules ext/ctype/ctype.lo So need linker flags are there...
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle. Changing version to '28'.
Looks like it was the usual libtool issue (which drops random flags from the command line). The redhat-rpm-config workaround in bug 1548397 has helped. php-7.2.3-1.fc28 looks good.
Great, thanks for checking.