Hi!
Post by Niels Thykier* If we were to enable -fPIE/-pie by default in GCC-6, should that change
also apply to this port? [0]
If -fPIE is the default will -fPIC override it?
It will also default to tell the linker to use -pie, but then
don't do it when you want to create a shared library?
I believe so. At least, Ubuntu made PIE default in their compiler
without having to change all SO packages to still build.
As I mentioned on IRC, the Gentoo people seems to have done so as well
in their Gentoo Hardened Toolchain project
<https://wiki.gentoo.org/wiki/Project:Hardened/Toolchain>.
Post by Niels ThykierAdmittedly, it could also be that GCC uses some built "compiler spec"
files for this case (a la an implicit "-specs=$FILE"), which are similar
to those Redhat uses for this purposes (see [1] for an example of such
files).
I think there are some bugs tracked in Fedora about this
<https://fedoraproject.org/wiki/Changes/Harden_All_Packages>, And this
is what I based the dpkg patch on as a potential alternative instead
of modifying our toolchain, which I think would be preferable. But see
below.
Post by Niels ThykierFrom what I understand, depending on what the .o file is going to
- shared library: -fPIC
- executable: -fPIC or -fPIE both work, but prefer -fPIE
- static library: Same as executables
For static libraries we now have a policy to not use -fPIC,
should that then get replaced by using -fPIE?
Honestly, I had not thought about that. From the looks of it, de facto
we will end up with -fPIE being the default for static libraries as well.
I would be supporting that change on the assumption that it requires
less work from individual maintainers (and presumably has no notable
downsides in the final result).
I think that's what we are getting right now for any package enabling
the "pie" build flags feature anyway.
Post by Niels Thykierpie-compile.specs
"""
+ %{!r:%{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}}
"""
"""
+ %{!shared:%{!r:-pie}}
"""
NB: I manually carved them out of a diff without testing them.
That would be
<https://git.hadrons.org/cgit/debian/dpkg/dpkg.git/commit/?h=pu/dpkg-buildflags-pie-gcc-specs&id=ad4854b4b4711dd49e39371280f0609f8b81c2a6>,
which neither I tested. Testing should first be done for gcc, g++, gcj,
gobjc, gobjc++, gccgo (although I've not managed to use shared libraries
with latest releases, but used to be able to) and gfortran. If someone
wants to test these first to see if it works and then later on do an
archive rebuild, that would also be appreciated.
At that point I could then at least switch the current implementation
so that we can just enable the "pie" feature per package regardless of
it building prorgrams or shared libraries. Enabling it by default
globally would require the usual process described in the dpkg FAQ.
Thanks,
Guillem