Bug 9486

Summary: security_flags.inc has many exception packages compiled without -PIE security flag
Product: [Build System, Metadata & Runtime] Security - Recipe Upgrade Reporter: Elena Reshetova <elena.reshetova>
Component: securityAssignee: Alexander Kanavin <alex.kanavin>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium CC: alex.kanavin, joshuagloe, juro.bystricky, richard.purdie
Version: unspecified   
Target Milestone: 2.2   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Elena Reshetova 2016-04-19 14:52:55 UTC 
security_flags.inc has exception packages that are not compiled with -PIE security flag due to compilation issue. Instead they should be tried to compile with -fpic flag that provides similar protection from security side. 

See https://git.yoctoproject.org/cgit/cgit.cgi/poky/tree/meta/conf/distro/include/security_flags.inc
Comment 1 Alexander Kanavin 2016-04-19 16:38:33 UTC 
It should be clarified that -fpic provides similar protection only for executable binaries. For libraries it makes no difference, if I'm reading the gcc manual correctly.
Comment 2 Alexander Kanavin 2016-06-14 12:26:32 UTC 
I got the manual backwards - PIE is for executables, PIC is for libraries. Anyway, I added -fPIC to SECURITY_NO_PIE_CFLAGS, and nothing failed, so I guess it can be enabled like that. I don't really know the difference between these flags, and gcc manual doesn't explain it well:
https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html

The patch is coming to mailing list shortly.