cmake vs DEB_BUILD_HARDENING vs 64-bit

[Pierre Chifflier <p.chifflier@inl.fr>]

Hi,

Maybe this should be pushed to cmake list, but I'd like to check if
there is a known solution first.

It seems that with current versions from unstable, programs using cmake
can't be build with hardening options on.
Even the simplest cmake project fails:

$ cat CMakeLists.txt
PROJECT(coin C)

$ DEB_BUILD_HARDENING=1 cmake .
-- Check for working C compiler: /usr/bin/gcc
-- Check for working C compiler: /usr/bin/gcc -- broken
CMake Error: The C compiler "/usr/bin/gcc" is not able to compile a
simple test program.
It fails with the following output:
 /usr/bin/make -f CMakeFiles/cmTryCompileExec.dir/build.make
 CMakeFiles/cmTryCompileExec.dir/build
 make[1]: entrant dans le répertoire «
 /home/pollux/COIN/CMakeFiles/CMakeTmp »
 /usr/bin/cmake -E cmake_progress_report
 /home/pollux/COIN/CMakeFiles/CMakeTmp/CMakeFiles 1
 Building C object CMakeFiles/cmTryCompileExec.dir/testCCompiler.o
 /usr/bin/gcc   -o CMakeFiles/cmTryCompileExec.dir/testCCompiler.o   -c
 /home/pollux/COIN/CMakeFiles/CMakeTmp/testCCompiler.c
 Linking C executable cmTryCompileExec
 /usr/bin/cmake -P
 CMakeFiles/cmTryCompileExec.dir/cmake_clean_target.cmake
 /usr/bin/gcc        -fPIC
 "CMakeFiles/cmTryCompileExec.dir/testCCompiler.o"   -o cmTryCompileExec
 -rdynamic 
 /usr/bin/ld.real:
 /usr/lib/gcc/x86_64-linux-gnu/4.2.3/../../../../lib64/crt1.o:
 relocation R_X86_64_32S against `__libc_csu_fini' can not be used when
 making a shared object; recompile with -fPIC
 /usr/lib/gcc/x86_64-linux-gnu/4.2.3/../../../../lib64/crt1.o: could not
 read symbols: Bad value

The error seems to be caused by cmake using the -fPIC option on 64-bits
executables. I searched how to disable it, but didn't find anything.

The same project builds without hardening options:
$ rm -rf CMakeCache.txt CMakeFiles
$ DEB_BUILD_HARDENING=0 cmake .
-- Check for working C compiler: /usr/bin/gcc
-- Check for working C compiler: /usr/bin/gcc -- works
-- Check size of void*
-- Check size of void* - done
-- Configuring done
-- Generating done
-- Build files have been written to: /home/pollux/COIN

Is there a known solution or workaround ? (I'll ask on the cmake list at
the same time).

Thanks,
Pierre