Re: Porter roll call for Debian Stretch
Hi!
On Sun, 2016-08-21 at 08:22:09 +0200, Niels Thykier wrote:
> Kurt Roeckx:
> > On Wed, Aug 17, 2016 at 10:05:06PM +0200, niels@thykier.net wrote:
> >> * If we were to enable -fPIE/-pie by default in GCC-6, should that change
> >> also apply to this port? [0]
> >
> > If -fPIE is the default will -fPIC override it?
> >
> > It will also default to tell the linker to use -pie, but then
> > don't do it when you want to create a shared library?
>
> I believe so. At least, Ubuntu made PIE default in their compiler
> without having to change all SO packages to still build.
As I mentioned on IRC, the Gentoo people seems to have done so as well
in their Gentoo Hardened Toolchain project
<https://wiki.gentoo.org/wiki/Project:Hardened/Toolchain>.
> Admittedly, it could also be that GCC uses some built "compiler spec"
> files for this case (a la an implicit "-specs=$FILE"), which are similar
> to those Redhat uses for this purposes (see [1] for an example of such
> files).
I think there are some bugs tracked in Fedora about this
<https://fedoraproject.org/wiki/Changes/Harden_All_Packages>, And this
is what I based the dpkg patch on as a potential alternative instead
of modifying our toolchain, which I think would be preferable. But see
below.
> >>From what I understand, depending on what the .o file is going to
> > be used for you want different things:
> > - shared library: -fPIC
> > - executable: -fPIC or -fPIE both work, but prefer -fPIE
> > - static library: Same as executables
> >
> > For static libraries we now have a policy to not use -fPIC,
> > should that then get replaced by using -fPIE?
> Honestly, I had not thought about that. From the looks of it, de facto
> we will end up with -fPIE being the default for static libraries as well.
> I would be supporting that change on the assumption that it requires
> less work from individual maintainers (and presumably has no notable
> downsides in the final result).
I think that's what we are getting right now for any package enabling
the "pie" build flags feature anyway.
> [1] Example spec files for this case seems to be something like:
>
> pie-compile.specs
> """
> *cc1_options:
> + %{!r:%{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}}
> """
>
> pie-link.specs:
> """
> *self_spec:
> + %{!shared:%{!r:-pie}}
> """
>
> NB: I manually carved them out of a diff without testing them.
That would be
<https://git.hadrons.org/cgit/debian/dpkg/dpkg.git/commit/?h=pu/dpkg-buildflags-pie-gcc-specs&id=ad4854b4b4711dd49e39371280f0609f8b81c2a6>,
which neither I tested. Testing should first be done for gcc, g++, gcj,
gobjc, gobjc++, gccgo (although I've not managed to use shared libraries
with latest releases, but used to be able to) and gfortran. If someone
wants to test these first to see if it works and then later on do an
archive rebuild, that would also be appreciated.
At that point I could then at least switch the current implementation
so that we can just enable the "pie" feature per package regardless of
it building prorgrams or shared libraries. Enabling it by default
globally would require the usual process described in the dpkg FAQ.
Thanks,
Guillem
Reply to: