Re: RELRO and Xorg

On Tue, Oct 01, 2013 at 11:59:33AM +0200, "Tóth Attila" wrote:
> You made me curious, so I took a look at on this.
>
> The eclass has a single function stating: "Set up CFLAGS for a debug
> build" in its description. Although it is not conditional for debug
> builds, so gets applied all the time, being called from the eclass'
> src_configure function. The filter flags statements are conditional and
> applied only in case of a static-libs build.
> Appending lazy binding is also conditional for Xorg and drivers.
>
> According to the Hardened/Toolchains wiki, one can find this section:
> "The following packages have issues with BIND_NOW at the time of writing,
> and it has to be relaxed somewhat for them:
>     X - some drivers consist of several libraries which are co-dependent,
> and the modules frequently have references to modules that they load.
>     transcode - relies on lazy binding to be able to load its modules; the
> issues are similar to the X issues."
>
> The function does not check whether the build happens on a hardened system
> or not.
>
> If you are using a hardened toolchain, relro and now is specified by
> default. I guess lazy takes precedence if present. Unless it would have no
> effect. I'm not sure what you mean by adding relro and now to the filters.
> Since these would be applied anyways by gcc specs. I'm also not sure what
> happens if both lazy and relro+now are appended at the same time.
>
> If I would try to test Xorg and its drivers with relro+now, I would
> comment out the append lazy line. I can give that a try if it is
> reasonable, but the statement in the wiki seems pretty clear. I don't know
> when those experiences described came from.
>
I've got an answer from Zorry via irc yesterday:
It seems like full RELRO used to break some graphics drivers. There seems to be
no real recent testing though.
From my experience I can tell that intel seems to work fine for me (Zorry
explicitely stated that radeon tend to break).
I've had no time to create a hardened environment on my only nvidia machine to
test nouveau and nvidia (the proprietary one).
Since I have no radeon I've got no chance to test that at all (the failure
happens on loading the driver, not build time sadly).

Bug #339984 is a relatively old tracker bug that doesn't reflect the current
state.

WKR
Hinnerk

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.21 (GNU/Linux)

iQEcBAEBAgAGBQJSSt2wAAoJEJwwOFaNFkYczrUH/3Cgz4ycqESRiV3zgMqkaHwR
XsNpFI7wfwqHYn1gOH+s/BOyXlnlmPjzIZFVcXDAO3x5bP6+Ym/MziieeeYKv/Ex
h/W6ruj/1gyv6twdZ1hXYipgFT3+AdtFSRA9631fjMSZu89t90zKAM0e1igoCure
zh7zcrrc1Aqo4tm72uDt/0xDnt68SZ0QH6iOIRAgbaCPQynIL8SiQxned38zdNlu
gW1VD47SjIQ8mV+1Bz9ouqYU/EOUL+rOEavFN2RBJ1xa0zqhczmtOMUncRVPH04T
5HmDnd1OfpFht6SJB0DBtiqpWCFfzaAFpMYuhNqDKT9FW1oVRJJ2gM5tKsFcndw=
=2i/N
-----END PGP SIGNATURE-----