Description of problem: The hardened build is disabled on aarch64. I don't seem to find any specific reason as to why that is. One comment suggested it fails to bootcycle-images build, but that does not seem the case for a scratch build which I've tried. Version-Release number of selected component (if applicable): java-1.8.0-openjdk-1.8.0.171-1.b10.fc28.aarch64 How reproducible: 100% Steps to Reproduce: 1. $ checksec --dir /usr/lib/jvm/java-1.8.0-openjdk/bin | grep 'No PIE' Actual results: Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/appletviewer Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/extcheck Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/idlj Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jar Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jarsigner Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/java Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/javac Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/javadoc Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/javah Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/javap Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jcmd Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jconsole Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jdb Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jdeps Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jhat Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jinfo Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jjs Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jmap Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jps Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jrunscript Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jsadebugd Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jstack Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jstat Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/jstatd Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/keytool Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/native2ascii Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/orbd Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/pack200 Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/policytool Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/rmic Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/rmid Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/rmiregistry Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/schemagen Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/serialver Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/servertool Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/tnameserv Partial RELRO Canary found NX enabled No PIE RPATH No RUNPATH Yes 0 8 /usr/lib/jvm/java-1.8.0-openjdk/bin/unpack200 Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/wsgen Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/wsimport Partial RELRO No canary found NX enabled No PIE RPATH No RUNPATH No 0 0 /usr/lib/jvm/java-1.8.0-openjdk/bin/xjc Expected results: Nothing (i.e. no match) Additional info: Scratch build which has hardening enabled: https://koji.fedoraproject.org/koji/taskinfo?taskID=26471763
Proposed fix: https://src.fedoraproject.org/rpms/java-1.8.0-openjdk/pull-request/4
It was disabled based on failures on RHEL 7. I don't believe Fedora even had AArch64 support back then. If it bootcycles on Fedora, then I see no issue with enabling it there. Fedora has a much newer version of GCC than RHEL 7 :)
Once this build completes this should be fixed: https://koji.fedoraproject.org/koji/buildinfo?buildID=1075249
java-1.8.0-openjdk-1.8.0.171-4.b10.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-f06de7cbbb
java-1.8.0-openjdk-1.8.0.171-4.b10.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1e5b8a00a0
java-1.8.0-openjdk-1.8.0.171-4.b10.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-f06de7cbbb
java-1.8.0-openjdk-1.8.0.171-4.b10.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1e5b8a00a0
java-1.8.0-openjdk-1.8.0.171-4.b10.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
java-1.8.0-openjdk-1.8.0.171-4.b10.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.