linux-kernel - Re: [PATCH 2/3] perf tools: Fix build for hardened environments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Nov 2017 08:36:22 +0100
From:   Jiri Olsa <jolsa@...hat.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     Jiri Olsa <jolsa@...nel.org>, lkml <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        David Ahern <dsahern@...il.com>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>
Subject: Re: [PATCH 2/3] perf tools: Fix build for hardened environments

On Wed, Nov 08, 2017 at 01:03:21PM -0300, Arnaldo Carvalho de Melo wrote:
> Em Wed, Nov 08, 2017 at 11:27:38AM +0100, Jiri Olsa escreveu:
> > From: Jiri Olsa <jolsa@...hat.com>
> > 
> > On Fedora systems the perl and python CFLAGS/LDFLAGS include the
> > hardened specs from redhat-rpm-config package. We apply them only
> > for perl/python objects, which makes them not compatible with the
> > rest of the objects and the build fails with:
> > 
> >   /usr/bin/ld: perf-in.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC
> >   /usr/bin/ld: libperf.a(libperf-in.o): relocation R_X86_64_32S against `.text' can not be used when making a shared object; recompile with -fPIC
> >   /usr/bin/ld: final link failed: Nonrepresentable section on output
> >   collect2: error: ld returned 1 exit status
> >   make[2]: *** [Makefile.perf:507: perf] Error 1
> >   make[1]: *** [Makefile.perf:210: sub-make] Error 2
> >   make: *** [Makefile:69: all] Error 2
> > 
> > Mainly it's caused by perl/python objects being compiled with:
> > 
> >   -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
> > 
> > which prevent the final link impossible, because it will check
> > for 'proper' objects with following option:
> > 
> >   -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
> > 
> > Fixing this by using the perl/python CFLAGS/LDFLAGS options
> > for all the objects.
> 
> Humm, so we're basically using the hardened config only we build with
> PERL or PYTHON, should we use that always, i.e. ask the distro what set
> of flags we should use?

right, I think this needs to be detected like we do for features,
since there maybe some supported gcc versions to detect

> What other impacts this may have on using this for all of the tools?
> I.e. we could conceivably just remove that part from the perl/python
> builds and make them use what has been used for the rest of the tools
> instead?

hum, so those are the flags the perl/python extensions are built with

we have both perl/python extensions built in the perf for the script cmd,
which creates dependencies:

	[jolsa@...va perf]$ ldd ./perf  |grep perl
		libperl.so.5.24 => /lib64/libperl.so.5.24 (0x00007f72b33b3000)
	[jolsa@...va perf]$ ldd ./perf  |grep python
		libpython2.7.so.1.0 => /lib64/libpython2.7.so.1.0 (0x00007f927cfe7000)

	not sure we could be affected here if we remove that hardened spec option

and then we have the python module extension which is used separately of
perf binary, which should be fine

jirka