Bug 807831 - default to partial relro
Summary: default to partial relro
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: binutils
Version: 17
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nick Clifton
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-28 20:43 UTC by Bill Nottingham
Modified: 2014-03-17 03:30 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-04-25 15:03:04 UTC
Type: ---


Attachments (Terms of Use)

Description Bill Nottingham 2012-03-28 20:43:09 UTC
Description of problem:

We want to have partial relro enabled everywhere. At the moment, we do that by setting a global LDFLAGS in redhat-rpm-config.

However, packages' build systems are dumb, and don't always notice this.

Ergo, it would be far simpler to just change the default in ld.

Version-Release number of selected component (if applicable):

binutils-2.21.53.0.1-6.fc16.x86_64

How reproducible:

100%

Comment 2 Jakub Jelinek 2012-03-28 21:00:59 UTC
What else is binutils-2.22.52.0.1-relro-on-by-default.patch in f18 binutils?

Comment 3 Bill Nottingham 2012-03-28 21:31:34 UTC
Ah, OK. I was looking at f17 builds.

That being said:

diff --git a/binutils.spec b/binutils.spec
index f4c2e8d..46ecc1d 100644
--- a/binutils.spec
+++ b/binutils.spec
@@ -149,7 +149,7 @@ using libelf instead of BFD.
 %patch08 -p1 -b .weakdef~
 %patch09 -p1 -b .ld-13621~
 %patch10 -p1 -b .cxxfilt-docs~
-%if 0%{?fedora} >= 18
+%if 0%{?fedora} >= 18 || 0%{?rhel} >= 7
 %patch11 -p0 -b .relro~
 %endif
 %patch12 -p0 -b .x86_64-hidden-ifunc~
@@ -459,7 +459,7 @@ exit 0
 - Fix up handling of hidden ifunc relocs on x86_64
 - Add Intel TSX support
 
-%if 0%{?fedora} >= 18
+%if 0%{?fedora} >= 18 || 0%{?rhel} >= 7
 * Tue Mar 06 2012 Nick Clifton <nickc> - 2.22.52.0.1-7
 - Enable -zrelro be default. (#621983)
 %endif

would be nice.

Comment 4 Steve Grubb 2012-04-25 14:43:25 UTC
Just checking on this. I was hoping it would have been in place by now. Any problems created by this patch?

Comment 5 Bill Nottingham 2012-04-25 15:03:04 UTC
Fixed in:
 
commit 29ab3f6c024684fa2ec527dda4949f9e2d97b079 (HEAD, origin/master, origin/HEA
Author: Nick Clifton <nickc>
Date:   Tue Apr 3 15:49:11 2012 +0100

    Enable -zrelro by default for RHEL 7+. (#807831)

in -11.


Note You need to log in before you can comment on or make changes to this bug.