[RFC] Enabling bindnow by default in dpkg-buildflags?

[Guillem Jover <guillem@debian.org>]

Hi!

This was discussed relatively recently, but it was not entirely clear
to me what was the conclusion, if there was any(?), about enabling
bindnow by default.

And although this got enabled by default in gcc-6 6.2.0-7 when PIE
also got enabled, it seems it got disabled in 6.2.0-10 when I pointed
out that enabling bindnow in gcc w/o enabling relro too didn't seem to
make much sense, but then I didn't notice any rationale for the
reversion, instead of say enabling relro too.


My mine concern is and has always been that bindnow changes the
run-time behavior (instead of the build-time one) and could break
things such as dlopen() on shared libraries or plugins and similar.
And detecting problems becomes harder, and reverting this change
iff we notice that it breaks too much might imply rebuilding an
unspecified number of packages. So in a way it feels kind of like
a transition?

OTOH Ubuntu seems to have been enabling not only PIE and bindnow by
default in gcc for a long time, but also relro, stack-protector and
fortify. Which would seem to imply this might not break that much?
(I'm not sure why we are not enabling all those in gcc in Debian
too, but that's probably a different conversation to have if at all.)


So at this point, I guess I still have concerns, but only very mild
ones, and would not mind one way or another, but would like input
from at least the release team, because I don't feel like possibly
deciding on this on my own, even more at this stage of the release.

Thanks,
Guillem