Re: Hardening powder

[Steven Hamilton <oz@scorch.net>]

On 10/05/13 19:50, Andrey Rahmatullin wrote:
> On Fri, May 10, 2013 at 07:38:01PM +1000, Steven Hamilton wrote:
> > PIE and Immediate binding I just can't seem to do. During
> > compilation I can see the following in the final executable so it
> > looks like the correct args are being passed.
> Wht args are you calling correct? There is nothing there about PIE (and
> can't be, it's a compiler option) or bindnow.

> bindnow and pie are disabled by default and you are not enabling them.

Thanks for that. You're right. I wasn't

I've updated the rules file with the following;

#!/usr/bin/make -f
# Uncomment this to turn on verbose mode.
export DH_VERBOSE=1
CPPFLAGS:=$(shell dpkg-buildflags --get CPPFLAGS)
CXXFLAGS:=$(shell dpkg-buildflags --get CXXFLAGS) $(CPPFLAGS)
LDFLAGS:=$(shell dpkg-buildflags --get LDFLAGS)
CXXFLAGS+=-z now

%:
	dh $@

override_dh_auto_build:
	dh_testdir
	echo "export LDFLAGS="$LDFLAGS /
	echo "export CXXFLAGS="$CXXFLAGS /
	bash -ex ./buildall.sh

So now I've appended the -z now option. Turns out I get a build failure 
with -pie. It seems to be a common problem. Is it fixable or is this as 
far as I can go?

PIE error;

/usr/bin/ld.bfd.real: bmp2c.o: relocation R_X86_64_32S against 
`_ZTVSt9basic_iosIcSt11char_traitsIcEE' can not be used when making a 
shared object; recompile with -fPIC
bmp2c.o: could not read symbols: Bad value
collect2: error: ld returned 1 exit status