Extend BIND_NOW to installed programs with --enable-bind-now

Message ID 87h8anr9jo.fsf@oldenburg2.str.redhat.com
State New
Headers show
Series
  • Extend BIND_NOW to installed programs with --enable-bind-now
Related show

Commit Message

Florian Weimer April 24, 2019, 10:18 a.m.
We received guidance that we should also enable BIND_NOW for installed
programs.  I think we can reuse the --enable-bind-now flag for that.

Thanks,
Florian
---

Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix
--enable-bind-now [BZ #21015]") extended BIND_NOW to all installed
shared objects.  This change also covers installed programs.

2019-04-24  Florian Weimer  <fweimer@redhat.com>

	Also enable BIND_NOW for programs if --enable-bind-now.
	* Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now.
	(+link-pie): Use $(link-extra-flags).
	[! $(build-pie-default)] (+link): Likewise.
	* manual/install.texi (Configuring and compiling): Update
	--enable-bind-now description.
	* INSTALL: Regenerated.

Comments

Florian Weimer April 24, 2019, 1:57 p.m. | #1
It turns out that static PIE programs benefit from -z now as well (more
RELRO coverage), so the patch below is a small improvement over the
first patch.

Thanks,
Florian

Extend BIND_NOW to installed programs with --enable-bind-now

Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix
--enable-bind-now [BZ #21015]") extended BIND_NOW to all installed
shared objects.  This change also covers installed programs.

2019-04-24  Florian Weimer  <fweimer@redhat.com>

	Also enable BIND_NOW for programs if --enable-bind-now.
	* Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now.
	(+link-pie): Use $(link-extra-flags).
	(+link-static): Likewise.
	[! $(build-pie-default)] (+link): Likewise.
	* manual/install.texi (Configuring and compiling): Update
	--enable-bind-now description.
	* INSTALL: Regenerated.

diff --git a/INSTALL b/INSTALL
index ddb9e9018d..e137a71169 100644
--- a/INSTALL
+++ b/INSTALL
@@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization.  For example:
      protection.
 
 '--enable-bind-now'
-     Disable lazy binding for installed shared objects.  This provides
-     additional security hardening because it enables full RELRO and a
-     read-only global offset table (GOT), at the cost of slightly
-     increased program load times.
+     Disable lazy binding for installed shared objects and programs.
+     This provides additional security hardening because it enables full
+     RELRO and a read-only global offset table (GOT), at the cost of
+     slightly increased program load times.
 
 '--enable-pt_chown'
      The file 'pt_chown' is a helper binary for 'grantpt' (*note
diff --git a/Makeconfig b/Makeconfig
index 07007c9459..89443e9a90 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -398,6 +398,8 @@ endif
 # test modules.
 ifeq ($(bind-now),yes)
 LDFLAGS-lib.so += -Wl,-z,now
+# Extra flags for dynamically linked non-test main programs.
+link-extra-flags += -Wl,-z,now
 endif
 
 # Command to run after every final link (executable or shared object).
@@ -426,7 +428,7 @@ ifndef +link-pie
 	     $(link-extra-libs)
 +link-pie-after-libc = $(+postctorS) $(+postinit)
 define +link-pie
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
 $(call after-link,$@)
 endef
 define +link-pie-tests
@@ -454,7 +456,7 @@ ifndef +link-static
 	      $(link-extra-libs-static)
 +link-static-after-libc = $(+postctorT) $(+postinit)
 define +link-static
-$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)
+$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
 $(call after-link,$@)
 endef
 define +link-static-tests
@@ -485,7 +487,7 @@ else  # not build-pie-default
 	      $(link-extra-libs)
 +link-after-libc = $(+postctor) $(+postinit)
 define +link
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
+$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
 $(call after-link,$@)
 endef
 define +link-tests
diff --git a/NEWS b/NEWS
index 63581b3618..792ffb1ec8 100644
--- a/NEWS
+++ b/NEWS
@@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility:
 * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub
   resolver have been removed from <resolv.h>.
 
+* With --enable-bind-now, installed programs are now linked with the
+  BIND_NOW flag.
+
 Changes to build and runtime requirements:
 
 * GCC 6.2 or later is required to build the GNU C Library.
diff --git a/manual/install.texi b/manual/install.texi
index a9b8b4974c..29f6b68e25 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this
 protection.
 
 @item --enable-bind-now
-Disable lazy binding for installed shared objects.  This provides
-additional security hardening because it enables full RELRO and a
-read-only global offset table (GOT), at the cost of slightly increased
-program load times.
+Disable lazy binding for installed shared objects and programs.  This
+provides additional security hardening because it enables full RELRO
+and a read-only global offset table (GOT), at the cost of slightly
+increased program load times.
 
 @pindex pt_chown
 @findex grantpt
Carlos O'Donell April 24, 2019, 3:28 p.m. | #2
On 4/24/19 9:57 AM, Florian Weimer wrote:
> It turns out that static PIE programs benefit from -z now as well (more

> RELRO coverage), so the patch below is a small improvement over the

> first patch.


LGTM.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>


> Extend BIND_NOW to installed programs with --enable-bind-now

> 

> Commit 2d6ab5df3b675e96ee587ae6a8c2ce004c6b1ba9 ("Document and fix

> --enable-bind-now [BZ #21015]") extended BIND_NOW to all installed

> shared objects.  This change also covers installed programs.

> 

> 2019-04-24  Florian Weimer  <fweimer@redhat.com>

> 

> 	Also enable BIND_NOW for programs if --enable-bind-now.

> 	* Makeconfig [$(bind-now)] (link-extra-flags): Add -Wl,-z,now.

> 	(+link-pie): Use $(link-extra-flags).

> 	(+link-static): Likewise.


OK.

> 	[! $(build-pie-default)] (+link): Likewise.

> 	* manual/install.texi (Configuring and compiling): Update

> 	--enable-bind-now description.

> 	* INSTALL: Regenerated.

> 

> diff --git a/INSTALL b/INSTALL

> index ddb9e9018d..e137a71169 100644

> --- a/INSTALL

> +++ b/INSTALL

> @@ -176,10 +176,10 @@ if 'CFLAGS' is specified it must enable optimization.  For example:

>        protection.

>   

>   '--enable-bind-now'

> -     Disable lazy binding for installed shared objects.  This provides

> -     additional security hardening because it enables full RELRO and a

> -     read-only global offset table (GOT), at the cost of slightly

> -     increased program load times.

> +     Disable lazy binding for installed shared objects and programs.

> +     This provides additional security hardening because it enables full

> +     RELRO and a read-only global offset table (GOT), at the cost of

> +     slightly increased program load times.

>   

>   '--enable-pt_chown'

>        The file 'pt_chown' is a helper binary for 'grantpt' (*note

> diff --git a/Makeconfig b/Makeconfig

> index 07007c9459..89443e9a90 100644

> --- a/Makeconfig

> +++ b/Makeconfig

> @@ -398,6 +398,8 @@ endif

>   # test modules.

>   ifeq ($(bind-now),yes)

>   LDFLAGS-lib.so += -Wl,-z,now

> +# Extra flags for dynamically linked non-test main programs.

> +link-extra-flags += -Wl,-z,now


OK. Adds to link-extra-flags used by programs only under $(bind-now) being
selected.

>   endif

>   

>   # Command to run after every final link (executable or shared object).

> @@ -426,7 +428,7 @@ ifndef +link-pie

>   	     $(link-extra-libs)

>   +link-pie-after-libc = $(+postctorS) $(+postinit)

>   define +link-pie

> -$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)

> +$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)


OK. Add to link command for linking pie programs.

>   $(call after-link,$@)

>   endef

>   define +link-pie-tests

> @@ -454,7 +456,7 @@ ifndef +link-static

>   	      $(link-extra-libs-static)

>   +link-static-after-libc = $(+postctorT) $(+postinit)

>   define +link-static

> -$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)

> +$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)


OK. Likewise for static programs.

>   $(call after-link,$@)

>   endef

>   define +link-static-tests

> @@ -485,7 +487,7 @@ else  # not build-pie-default

>   	      $(link-extra-libs)

>   +link-after-libc = $(+postctor) $(+postinit)

>   define +link

> -$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)

> +$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)


OK. Likewise for normal programs (non-PIE, non-static).

>   $(call after-link,$@)

>   endef

>   define +link-tests

> diff --git a/NEWS b/NEWS

> index 63581b3618..792ffb1ec8 100644

> --- a/NEWS

> +++ b/NEWS

> @@ -47,6 +47,9 @@ Deprecated and removed features, and other changes affecting compatibility:

>   * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub

>     resolver have been removed from <resolv.h>.

>   

> +* With --enable-bind-now, installed programs are now linked with the

> +  BIND_NOW flag.


OK. Perfect. Thanks for the NEWS entry.

> +

>   Changes to build and runtime requirements:

>   

>   * GCC 6.2 or later is required to build the GNU C Library.

> diff --git a/manual/install.texi b/manual/install.texi

> index a9b8b4974c..29f6b68e25 100644

> --- a/manual/install.texi

> +++ b/manual/install.texi

> @@ -204,10 +204,10 @@ number of routines called directly from assembler are excluded from this

>   protection.

>   

>   @item --enable-bind-now

> -Disable lazy binding for installed shared objects.  This provides

> -additional security hardening because it enables full RELRO and a

> -read-only global offset table (GOT), at the cost of slightly increased

> -program load times.

> +Disable lazy binding for installed shared objects and programs.  This

> +provides additional security hardening because it enables full RELRO

> +and a read-only global offset table (GOT), at the cost of slightly

> +increased program load times.


OK. Looks good.

>   

>   @pindex pt_chown

>   @findex grantpt

> 



-- 
Cheers,
Carlos.

Patch

diff --git a/INSTALL b/INSTALL
index ddb9e9018d..e137a71169 100644
--- a/INSTALL
+++ b/INSTALL
@@ -176,10 +176,10 @@  if 'CFLAGS' is specified it must enable optimization.  For example:
      protection.
 
 '--enable-bind-now'
-     Disable lazy binding for installed shared objects.  This provides
-     additional security hardening because it enables full RELRO and a
-     read-only global offset table (GOT), at the cost of slightly
-     increased program load times.
+     Disable lazy binding for installed shared objects and programs.
+     This provides additional security hardening because it enables full
+     RELRO and a read-only global offset table (GOT), at the cost of
+     slightly increased program load times.
 
 '--enable-pt_chown'
      The file 'pt_chown' is a helper binary for 'grantpt' (*note
diff --git a/Makeconfig b/Makeconfig
index 07007c9459..768df2c3ef 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -398,6 +398,8 @@  endif
 # test modules.
 ifeq ($(bind-now),yes)
 LDFLAGS-lib.so += -Wl,-z,now
+# Extra flags for dynamically linked non-test main programs.
+link-extra-flags += -Wl,-z,now
 endif
 
 # Command to run after every final link (executable or shared object).
@@ -426,7 +428,7 @@  ifndef +link-pie
 	     $(link-extra-libs)
 +link-pie-after-libc = $(+postctorS) $(+postinit)
 define +link-pie
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
 $(call after-link,$@)
 endef
 define +link-pie-tests
@@ -485,7 +487,7 @@  else  # not build-pie-default
 	      $(link-extra-libs)
 +link-after-libc = $(+postctor) $(+postinit)
 define +link
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
+$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
 $(call after-link,$@)
 endef
 define +link-tests
diff --git a/NEWS b/NEWS
index 63581b3618..792ffb1ec8 100644
--- a/NEWS
+++ b/NEWS
@@ -47,6 +47,9 @@  Deprecated and removed features, and other changes affecting compatibility:
 * The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub
   resolver have been removed from <resolv.h>.
 
+* With --enable-bind-now, installed programs are now linked with the
+  BIND_NOW flag.
+
 Changes to build and runtime requirements:
 
 * GCC 6.2 or later is required to build the GNU C Library.
diff --git a/manual/install.texi b/manual/install.texi
index a9b8b4974c..29f6b68e25 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -204,10 +204,10 @@  number of routines called directly from assembler are excluded from this
 protection.
 
 @item --enable-bind-now
-Disable lazy binding for installed shared objects.  This provides
-additional security hardening because it enables full RELRO and a
-read-only global offset table (GOT), at the cost of slightly increased
-program load times.
+Disable lazy binding for installed shared objects and programs.  This
+provides additional security hardening because it enables full RELRO
+and a read-only global offset table (GOT), at the cost of slightly
+increased program load times.
 
 @pindex pt_chown
 @findex grantpt