Created attachment 65965 [details] [review] cflags-znow.patch As systemd is talking dbus it should get some more binary hardening measures... (not sure if there is another bug for this already) I suggest to just enable the flags for everything, as there should be no noticable performance impact or functional change.
Actually, we already set znow: http://cgit.freedesktop.org/systemd/systemd/tree/configure.ac#n134 is the fpie stuff supported properly by libtool and automake these days? i.e. afair we need to compile things differently for convenience libs and for shared libs. Does libtool/automake get that right automatically? Can you elaborate on this?
openSUSE 12.2 with libtool 2.4.2 and automake 1.12.1 cope fine. This libtool version filters out the -pie/-fPIE flags transparetnly while building libraries (and uses -fPIC there).
Hmm, are you suggesting that the hardened build RPM magic is not necessary anymore? https://lists.fedoraproject.org/pipermail/devel/2011-August/155358.html i.e. more specifically, that the -spec stuff it does is unnecessary for packages which use a recent automake/libtool? The reason we didn't add the pie stuff to systemd was mostly due to the requirement of that -spec stuff.
the hardenend build flags are related, yes. I am suggesting to systemd to do PIE for all its binaries by default without needing other hardening buildmagic.
(In reply to comment #4) > the hardenend build flags are related, yes. > > I am suggesting to systemd to do PIE for all its binaries by default > without needing other hardening buildmagic. Yes, I understand that, and I agree with it. I am just trying to wrap my head around this: why do we need the -spec file magic that is mentioned here: https://lists.fedoraproject.org/pipermail/devel/2011-August/155358.html Is that mostly redundant now because libtool/automake got updated and don't need this stuff anymore, or does the -spec stuff actually have any benefits still?
I think it is largely for upstream programs that do not want to do this by default, or have no more upstream releases or other reasons.
This is in place since a few days in git now. Closing.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.