linux-kernel - Re: -fno-PIE, take #3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1478645477.1727.18.camel@decadent.org.uk>
Date:   Tue, 08 Nov 2016 22:51:17 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        linux-kernel@...r.kernel.org
Cc:     Michal Marek <mmarek@...e.com>, linux-kbuild@...r.kernel.org,
        x86@...nel.org, Al Viro <viro@...IV.linux.org.uk>,
        Sven Joachim <svenjoac@....de>,
        "Austin S. Hemmelgarn" <ahferroin7@...il.com>,
        Borislav Petkov <bp@...en8.de>
Subject: Re: -fno-PIE, take #3

On Fri, 2016-11-04 at 19:39 +0100, Sebastian Andrzej Siewior wrote:
> Debian gcc's is nowdays compiled with --enable-default-pie which means it does
> -fPIE by default. This breaks atleast x86-64 compiles.
> This is the third attempt to fix it, this time by using runtime detection of
> the -fno-PIE compiler switch (it was introduced in gcc 3.4, min required gcc is
> currently 3.2) so it can be backported to the stable kernels.
> As noted by Al this won't fix `git bisect' of stable kernels prio this commit.
> However using always a wrapper around gcc which adds -fno-PIE is not sollution
> I want to rely in future.

I applied the previous version of "kbuild: add -fno-PIE" plus
"scripts/has-stack-protector: add -fno-PIE" to the Debian kernel
package of v4.9-rc3 and built with gcc-6, and the results of auto-
building so far are (from
<https://buildd.debian.org/status/package.php?p=linux&suite=experimental>):

Debian    Description                  Result
name
----------------------------------------------
amd64     x86_64                       OK
arm64     ARMv8                        OK
armel     ARMv5                        pending
armhf     ARMv7                        pending
i386      i686                         OK
mips      MIPS{32,64}r2 big-endian     OK
mipsel    MIPS{32,64}r2 little-endian  pending
mips64el  MIPS64r2, little-endian      pending
ppc64el   POWER8, little-endian        OK
s390x     s390x                        OK

PIE has not been enabled by default on other Debian architectures.  The
build failures on hppa and sparc64 are unrelated.

We do enable CONFIG_KEXEC_FILE on amd64 so I don't know how why that
build succeeded without "x86/kexec: add -fno-PIE".

Ben.

-- 
Ben Hutchings
For every complex problem
there is a solution that is simple, neat, and wrong.

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)