linux-kernel - Re: [PATCH 2/3] perf tools: Fix build for hardened environments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Nov 2017 11:15:32 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Jiri Olsa <jolsa@...nel.org>, lkml <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        David Ahern <dsahern@...il.com>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>
Subject: Re: [PATCH 2/3] perf tools: Fix build for hardened environments

Em Fri, Nov 10, 2017 at 10:43:25AM +0100, Jiri Olsa escreveu:
> On Thu, Nov 09, 2017 at 09:52:12AM -0300, Arnaldo Carvalho de Melo wrote:
> > Em Thu, Nov 09, 2017 at 08:36:22AM +0100, Jiri Olsa escreveu:
> > > On Wed, Nov 08, 2017 at 01:03:21PM -0300, Arnaldo Carvalho de Melo wrote:
> > > > Em Wed, Nov 08, 2017 at 11:27:38AM +0100, Jiri Olsa escreveu:
> > > > > Mainly it's caused by perl/python objects being compiled with:

> > > > >   -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1

> > > > > which prevent the final link impossible, because it will check
> > > > > for 'proper' objects with following option:

> > > > >   -specs=/usr/lib/rpm/redhat/redhat-hardened-ld

> > > > > Fixing this by using the perl/python CFLAGS/LDFLAGS options
> > > > > for all the objects.

> > > > Humm, so we're basically using the hardened config only we build with
> > > > PERL or PYTHON, should we use that always, i.e. ask the distro what set
> > > > of flags we should use?

> > > right, I think this needs to be detected like we do for features,
> > > since there maybe some supported gcc versions to detect

> > Right, since we want to honour what the distro makers decided was the
> > best set for them, and to be able to link with other libraries, etc.

> > But then I think this should be done more explicitely, right? Do you
> > envision some way to do that without having to try to build perl or
> > python, that may not be installed, etc?
 
> I'll check on it.. I think we could use feature detection and
> enable that by default and add NO_HARDENED_BUILD variable as
> we do for features.. and detect that python/perl or whatever
> else is using that and warn

I stumbled it on a recently created perf build container for fedora 27:

fedora:27
Downloading http://192.168.124.1/perf/perf-4.14.0.tar.xz...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

make: Entering directory '/git/linux/tools/perf'
  BUILD:   Doing 'make -j4 parallel build
  HOSTCC   /tmp/build/perf/fixdep.o
  HOSTLD   /tmp/build/perf/fixdep-in.o
  LINK     /tmp/build/perf/fixdep

Auto-detecting system features:
...                         dwarf: [ on ]
...            dwarf_getlocations: [ on ]
...                         glibc: [ on ]
...                          gtk2: [ on ]
...                      libaudit: [ on ]
...                        libbfd: [ on ]
...                        libelf: [ on ]
...                       libnuma: [ on ]
...        numa_num_possible_cpus: [ on ]
...                       libperl: [ on ]
...                     libpython: [ on ]
...                      libslang: [ on ]
...                     libcrypto: [ on ]
...                     libunwind: [ on ]
...            libdw-dwarf-unwind: [ on ]
...                          zlib: [ on ]
...                          lzma: [ on ]
...                     get_cpuid: [ on ]
...                           bpf: [ on ]

Makefile.config:813: No openjdk development package found, please install JDK package
  GEN      /tmp/build/perf/common-cmds.h
  PERF_VERSION = 4.14.geae86e
  MKDIR    /tmp/build/perf/fd/
  CC       /tmp/build/perf/fd/array.o
  CC       /tmp/build/perf/exec-cmd.o
  CC       /tmp/build/perf/util/parse-events-flex.o
<SNIP>
  LD       /tmp/build/perf/util/libperf-in.o
  LD       /tmp/build/perf/libperf-in.o
  AR       /tmp/build/perf/libperf.a
  LINK     /tmp/build/perf/perf
  LINK     /tmp/build/perf/libperf-gtk.so
/usr/bin/ld: /tmp/build/perf/perf-in.o: relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: /tmp/build/perf/libperf.a(libperf-in.o): relocation R_X86_64_32S against `.text' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Nonrepresentable section on output
collect2: error: ld returned 1 exit status
make[2]: *** [Makefile.perf:507: /tmp/build/perf/perf] Error 1
make[1]: *** [Makefile.perf:210: sub-make] Error 2
make: *** [Makefile:70: all] Error 2
make: Leaving directory '/git/linux/tools/perf'