Bug 9486 - security_flags.inc has many exception packages compiled without -PIE security flag
Summary: security_flags.inc has many exception packages compiled without -PIE security...
Status: RESOLVED FIXED
Alias: None
Product: Security - Recipe Upgrade
Classification: Build System, Metadata & Runtime
Component: security (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium normal
Target Milestone: 2.2
Assignee: Alexander Kanavin
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2016-04-19 14:52 UTC by Elena Reshetova
Modified: 2016-08-29 12:23 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Elena Reshetova 2016-04-19 14:52:55 UTC 
security_flags.inc has exception packages that are not compiled with -PIE security flag due to compilation issue. Instead they should be tried to compile with -fpic flag that provides similar protection from security side. 

See https://git.yoctoproject.org/cgit/cgit.cgi/poky/tree/meta/conf/distro/include/security_flags.inc
Comment 1 Alexander Kanavin 2016-04-19 16:38:33 UTC 
It should be clarified that -fpic provides similar protection only for executable binaries. For libraries it makes no difference, if I'm reading the gcc manual correctly.
Comment 2 Alexander Kanavin 2016-06-14 12:26:32 UTC 
I got the manual backwards - PIE is for executables, PIC is for libraries. Anyway, I added -fPIC to SECURITY_NO_PIE_CFLAGS, and nothing failed, so I guess it can be enabled like that. I don't really know the difference between these flags, and gcc manual doesn't explain it well:
https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html

The patch is coming to mailing list shortly.