linux-kernel - Re: [PATCH 2/2] kbuild: add -fno-PIE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Nov 2016 01:08:11 +0000
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Ben Hutchings <ben@...adent.org.uk>
Cc:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        linux-kernel@...r.kernel.org, Sven Joachim <svenjoac@....de>,
        Tomas Janousek <tomi@...i.cz>, Joe Perches <joe@...ches.com>,
        Adam Borowski <kilobyte@...band.pl>,
        Michal Marek <mmarek@...e.com>, linux-kbuild@...r.kernel.org
Subject: Re: [PATCH 2/2] kbuild: add -fno-PIE

On Thu, Nov 03, 2016 at 04:50:55PM -0600, Ben Hutchings wrote:
> On Wed, 2016-11-02 at 18:20 +0100, Sebastian Andrzej Siewior wrote:
> > Debian started to build the gcc with -fPIE by default so the kernel
> > build ends before it starts properly with:
> > |kernel/bounds.c:1:0: error: code model kernel does not support PIC mode
> > 
> > 
> > Also add to KBUILD_AFLAGSi due to:
> > 
> > |gcc -Wp,-MD,arch/x86/entry/vdso/vdso32/.note.o.d … -mfentry -DCC_USING_FENTRY … vdso/vdso32/note.S
> > |arch/x86/entry/vdso/vdso32/note.S:1:0: sorry, unimplemented: -mfentry isn’t supported for 32-bit in c ombination with -fpic
> [...]
> 
> Unfortunately this isn't sufficient:
> 
> Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong available but compiler is broken
> /build/linux-4.9~rc3/Makefile:1069: recipe for target 'prepare-compiler-check' failed
> make[5]: *** [prepare-compiler-check] Error 1
> 
> scripts/gcc-x86_64-has-stack-protector.sh has its own list of options
> which will need to include -fno-PIE.

That shit should be fixed in debian; no amount of kbuild changes will help
on bisect going back to a state prior to those.  IOW, no matter what we
do kernel-side, that fuckup by doku, balint, et.al. needs to be fixed in
debian gcc package.

Al, seriously disappointed by that mess - debian gcc packagers are generally
clued enough to have known better.  Reassigning bug reports in question
from gcc-6 to linux is beyond stupid; Balint is either being deliberately
obtuse, or geniunely unable to imagine that somebody might be using the
compiler _not_ for debian package builds.