External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-03 11:51:11 +00:00
Code Issues Packages Projects Releases Wiki Activity
b56950fd27
libvirt/m4/virt-compile-pie.m4

36 lines
1.2 KiB
Plaintext
Raw Normal View History

Build all binaries with PIE PIE (position independent executable) adds security to executables by composing them entirely of position-independent code (PIC. The .so libraries already build with -fPIC. This adds -fPIE which is the equivalent to -fPIC, but for executables. This for allows Exec Shield to use address space layout randomization to prevent attackers from knowing where existing executable code is during a security attack using exploits that rely on knowing the offset of the executable code in the binary, such as return-to-libc attacks. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-03 10:32:15 +00:00
dnl
dnl Check for support for position independent executables
dnl
dnl Copyright (C) 2013 Red Hat, Inc.
dnl
dnl This library is free software; you can redistribute it and/or
dnl modify it under the terms of the GNU Lesser General Public
dnl License as published by the Free Software Foundation; either
dnl version 2.1 of the License, or (at your option) any later version.
dnl
dnl This library is distributed in the hope that it will be useful,
dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
dnl Lesser General Public License for more details.
dnl
dnl You should have received a copy of the GNU Lesser General Public
dnl License along with this library. If not, see
dnl <http://www.gnu.org/licenses/>.
dnl
AC_DEFUN([LIBVIRT_COMPILE_PIE],[
PIE_CFLAGS=
PIE_LDFLAGS=
Don't enable -fPIE on Win32 platforms On win32, all code is position independent and adding -fPIE to the compiler flags results in warnings being printed Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-15 15:56:38 +00:00
case "$host" in
*-*-mingw* | *-*-msvc* | *-*-cygwin* )
;; dnl All code is position independent on Win32 target
*)
maint: extend PIE support check GCC installed from FreeBSD ports doesn't support building PIE executables and fails with: /usr/local/bin/ld: /usr/lib/crt1.o: relocation R_X86_64_32 against `_DYNAMIC' can not be used when making a shared object; recompile with -fPIC /usr/lib/crt1.o: error adding symbols: Bad value collect2: error: ld returned 1 exit status However, the configure check for '-fPIC -DPIC' doesn't catch that. In order to catch this case, add '-pie' to CFLAGS in m4/virt-compile-pie.m4 so it could detect lack of PIE support on configure time and don't fail the build.
2015-05-09 16:06:36 +00:00
gl_COMPILER_OPTION_IF([-fPIE -DPIE -pie], [
Fix '-pie' build with clang Commit 97e70a593589e8f0432a748b4b93c3cdc18b9e5a added the option -pie to CFLAGS and LDFLAGS, however '-pie' is just a linker option. That wouldn't be a problem. However, clang is checking for that and outputs an error or unused argument: error: argument unused during compilation: '-pie' Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
2016-02-09 11:33:29 +00:00
PIE_CFLAGS="-fPIE -DPIE"
Build all binaries with PIE PIE (position independent executable) adds security to executables by composing them entirely of position-independent code (PIC. The .so libraries already build with -fPIC. This adds -fPIE which is the equivalent to -fPIC, but for executables. This for allows Exec Shield to use address space layout randomization to prevent attackers from knowing where existing executable code is during a security attack using exploits that rely on knowing the offset of the executable code in the binary, such as return-to-libc attacks. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-03 10:32:15 +00:00
PIE_LDFLAGS="-pie"
Don't enable -fPIE on Win32 platforms On win32, all code is position independent and adding -fPIE to the compiler flags results in warnings being printed Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-15 15:56:38 +00:00
])
esac
Build all binaries with PIE PIE (position independent executable) adds security to executables by composing them entirely of position-independent code (PIC. The .so libraries already build with -fPIC. This adds -fPIE which is the equivalent to -fPIC, but for executables. This for allows Exec Shield to use address space layout randomization to prevent attackers from knowing where existing executable code is during a security attack using exploits that rely on knowing the offset of the executable code in the binary, such as return-to-libc attacks. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-03 10:32:15 +00:00
AC_SUBST([PIE_CFLAGS])
AC_SUBST([PIE_LDFLAGS])
])
Reference in New Issue Copy Permalink