public inbox for gcc-patches@gcc.gnu.org
 help / color / mirror / Atom feed
* [PATCH] configure: Implement --enable-host-bind-now
@ 2022-11-11  2:53 Marek Polacek
  2022-11-20 15:09 ` Jeff Law
  0 siblings, 1 reply; 11+ messages in thread
From: Marek Polacek @ 2022-11-11  2:53 UTC (permalink / raw)
  To: GCC Patches; +Cc: oliva, Joseph Myers

This is a rebased version of the patch I posted in February:
<https://gcc.gnu.org/pipermail/gcc-patches/2022-February/590201.html>.

Fortunately it is much simpler than the patch implementing --enable-host-pie.
I've converted the install.texi part into configuration.rst, otherwise
there are no changes to the original version.

With --enable-host-bind-now --enable-host-pie:
$ readelf -Wd ./gcc/cc1 ./gcc/cc1plus | grep FLAGS
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE

Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?

-- >8 --

As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening.  BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.

This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.

c++tools/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.
	* configure: Regenerate.

gcc/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Add
	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
	* configure: Regenerate.
	* doc/install/configuration.rst: Document --enable-host-bind-now.

lto-plugin/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Link with
	-z,now.
	* configure: Regenerate.
---
 c++tools/configure                | 11 +++++++++++
 c++tools/configure.ac             |  7 +++++++
 gcc/configure                     | 20 ++++++++++++++++++--
 gcc/configure.ac                  | 13 ++++++++++++-
 gcc/doc/install/configuration.rst |  7 +++++++
 lto-plugin/configure              | 20 ++++++++++++++++++--
 lto-plugin/configure.ac           | 11 +++++++++++
 7 files changed, 84 insertions(+), 5 deletions(-)

diff --git a/c++tools/configure b/c++tools/configure
index 88087009383..006efe07b35 100755
--- a/c++tools/configure
+++ b/c++tools/configure
@@ -628,6 +628,7 @@ EGREP
 GREP
 CXXCPP
 LD_PICFLAG
+enable_host_bind_now
 PICFLAG
 MAINTAINER
 CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
 enable_checking
 enable_default_pie
 enable_host_pie
+enable_host_bind_now
 with_gcc_major_version_only
 '
       ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
                           yes,no,all,none,release.
   --enable-default-pie    enable Position Independent Executable as default
   --enable-host-pie       build host code as PIE
+  --enable-host-bind-now  link host code as BIND_NOW
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
 
 
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
 
 # Check if O_CLOEXEC is defined by fcntl
 
diff --git a/c++tools/configure.ac b/c++tools/configure.ac
index 1e42689f2eb..d3f23f66f00 100644
--- a/c++tools/configure.ac
+++ b/c++tools/configure.ac
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
 		[build host code as PIE])],
 [PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
 AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+       [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
 AC_SUBST(LD_PICFLAG)
 
 # Check if O_CLOEXEC is defined by fcntl
diff --git a/gcc/configure b/gcc/configure
index 3e303f7e5bd..fb88e41f712 100755
--- a/gcc/configure
+++ b/gcc/configure
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
 LD_PICFLAG
 PICFLAG
 enable_default_pie
+enable_host_bind_now
 enable_host_pie
 enable_host_shared
 enable_plugin
@@ -1030,6 +1031,7 @@ enable_version_specific_runtime_libs
 enable_plugin
 enable_host_shared
 enable_host_pie
+enable_host_bind_now
 enable_libquadmath_support
 with_linker_hash_style
 with_diagnostics_color
@@ -1793,6 +1795,7 @@ Optional Features:
   --enable-plugin         enable plugin support
   --enable-host-shared    build host code as shared libraries
   --enable-host-pie       build host code as PIE
+  --enable-host-bind-now  link host code as BIND_NOW
   --disable-libquadmath-support
                           disable libquadmath support for Fortran
   --enable-default-pie    enable Position Independent Executable as default
@@ -19764,7 +19767,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 19779 "configure"
+#line 19782 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -19870,7 +19873,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 19885 "configure"
+#line 19888 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -32012,6 +32015,14 @@ fi
 
 
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now;
+fi
+
+
+
 # Check whether --enable-libquadmath-support was given.
 if test "${enable_libquadmath_support+set}" = set; then :
   enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32198,6 +32209,8 @@ else
   PICFLAG=
 fi
 
+
+
 if test x$enable_host_pie = xyes; then
   LD_PICFLAG=-pie
 elif test x$gcc_cv_no_pie = xyes; then
@@ -32206,6 +32219,9 @@ else
   LD_PICFLAG=
 fi
 
+if test x$enable_host_bind_now = xyes; then
+  LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
 
 
 
diff --git a/gcc/configure.ac b/gcc/configure.ac
index 29eeed7e569..fd6deaf82c8 100644
--- a/gcc/configure.ac
+++ b/gcc/configure.ac
@@ -7411,6 +7411,12 @@ AC_ARG_ENABLE(host-pie,
 		[build host code as PIE])])
 AC_SUBST(enable_host_pie)
 
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+		[link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
 AC_ARG_ENABLE(libquadmath-support,
 [AS_HELP_STRING([--disable-libquadmath-support],
   [disable libquadmath support for Fortran])],
@@ -7552,6 +7558,8 @@ else
   PICFLAG=
 fi
 
+AC_SUBST([PICFLAG])
+
 if test x$enable_host_pie = xyes; then
   LD_PICFLAG=-pie
 elif test x$gcc_cv_no_pie = xyes; then
@@ -7560,7 +7568,10 @@ else
   LD_PICFLAG=
 fi
 
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+  LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
 AC_SUBST([LD_PICFLAG])
 
 # Enable Intel CET on Intel CET enabled host if jit is enabled.
diff --git a/gcc/doc/install/configuration.rst b/gcc/doc/install/configuration.rst
index c2a9680e1e5..2a541f90156 100644
--- a/gcc/doc/install/configuration.rst
+++ b/gcc/doc/install/configuration.rst
@@ -446,6 +446,13 @@ corresponding :option:`--without` option.
   in which case :option:`-fPIC` is used when compiling, and :option:`-pie`
   when linking.
 
+.. option:: --enable-host-bind-now
+
+  Specify that the *host* executables should be linked with the option
+  :option:`-Wl,-z,now`, which means that the dynamic linker will resolve all
+  symbols when the executables are started, and that in turn allows RELRO to
+  mark the GOT read-only, resulting in better security.
+
 .. option:: --with-gnu-as
 
 .. _with-gnu-as:
diff --git a/lto-plugin/configure b/lto-plugin/configure
index d522bd24c95..3467defd416 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -663,6 +663,7 @@ accel_dir_suffix
 gcc_build_dir
 CET_HOST_FLAGS
 ac_lto_plugin_ldflags
+enable_host_bind_now
 ac_lto_plugin_warn_cflags
 EGREP
 GREP
@@ -778,6 +779,7 @@ enable_maintainer_mode
 with_libiberty
 enable_dependency_tracking
 enable_largefile
+enable_host_bind_now
 enable_cet
 with_gcc_major_version_only
 enable_shared
@@ -1425,6 +1427,7 @@ Optional Features:
   --disable-dependency-tracking
                           speeds up one-time build
   --disable-largefile     omit support for large files
+  --enable-host-bind-now  link host code as BIND_NOW
   --enable-cet            enable Intel CET in host libraries [default=auto]
   --enable-shared[=PKGS]  build shared libraries [default=yes]
   --enable-static[=PKGS]  build static libraries [default=yes]
@@ -5669,6 +5672,19 @@ if test "x$have_static_libgcc" = xyes; then
    ac_lto_plugin_ldflags="-Wc,-static-libgcc"
 fi
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+  ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
 
  # Check whether --enable-cet was given.
 if test "${enable_cet+set}" = set; then :
@@ -12134,7 +12150,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12137 "configure"
+#line 12165 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12240,7 +12256,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12243 "configure"
+#line 12271 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac
index 0a7202782ae..84f2a60b480 100644
--- a/lto-plugin/configure.ac
+++ b/lto-plugin/configure.ac
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
 if test "x$have_static_libgcc" = xyes; then
    ac_lto_plugin_ldflags="-Wc,-static-libgcc"
 fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+       [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+  ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
 AC_SUBST(ac_lto_plugin_ldflags)
 
 GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)

base-commit: 5c6546ca7d8cab1f1c129f5b55f709e2ceee0f94
prerequisite-patch-id: 312c7b6ec0b7c87f001758d071d26af5deae50c0
-- 
2.38.1


^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2022-11-11  2:53 [PATCH] configure: Implement --enable-host-bind-now Marek Polacek
@ 2022-11-20 15:09 ` Jeff Law
  0 siblings, 0 replies; 11+ messages in thread
From: Jeff Law @ 2022-11-20 15:09 UTC (permalink / raw)
  To: Marek Polacek, GCC Patches; +Cc: oliva, Joseph Myers


On 11/10/22 19:53, Marek Polacek via Gcc-patches wrote:
> This is a rebased version of the patch I posted in February:
> <https://gcc.gnu.org/pipermail/gcc-patches/2022-February/590201.html>.
>
> Fortunately it is much simpler than the patch implementing --enable-host-pie.
> I've converted the install.texi part into configuration.rst, otherwise
> there are no changes to the original version.
>
> With --enable-host-bind-now --enable-host-pie:
> $ readelf -Wd ./gcc/cc1 ./gcc/cc1plus | grep FLAGS
>   0x000000000000001e (FLAGS)              BIND_NOW
>   0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>   0x000000000000001e (FLAGS)              BIND_NOW
>   0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> -- >8 --
>
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening.  BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> c++tools/ChangeLog:
>
> 	* configure.ac (--enable-host-bind-now): New check.
> 	* configure: Regenerate.
>
> gcc/ChangeLog:
>
> 	* configure.ac (--enable-host-bind-now): New check.  Add
> 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> 	* configure: Regenerate.
> 	* doc/install/configuration.rst: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> 	* configure.ac (--enable-host-bind-now): New check.  Link with
> 	-z,now.
> 	* configure: Regenerate.
> ---

OK.  Glad to see this finally get to resolution.  While I'm largely in 
agreement with Jakub that PIE doesn't provide a major security benefit 
for the compiler, it seems better to not have the compiler be special 
WRT security options.


Jeff


^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-06-29 15:58     ` Martin Jambor
@ 2023-06-29 16:13       ` Marek Polacek
  0 siblings, 0 replies; 11+ messages in thread
From: Marek Polacek @ 2023-06-29 16:13 UTC (permalink / raw)
  To: Martin Jambor; +Cc: Eric Botcazou, GCC Patches

On Thu, Jun 29, 2023 at 05:58:22PM +0200, Martin Jambor wrote:
> Hi,
> 
> On Tue, Jun 27 2023, Marek Polacek wrote:
> > On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
> >> Hello,
> >> 
> >> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> >> > As promised in the --enable-host-pie patch, this patch adds another
> >> > configure option, --enable-host-bind-now, which adds -z now when linking
> >> > the compiler executables in order to extend hardening.  BIND_NOW with RELRO
> >> > allows the GOT to be marked RO; this prevents GOT modification attacks.
> >> >
> >> > This option does not affect linking of target libraries; you can use
> >> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> >> >
> >> > With this patch:
> >> > $ readelf -Wd cc1{,plus} | grep FLAGS
> >> >  0x000000000000001e (FLAGS)              BIND_NOW
> >> >  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
> >> >  0x000000000000001e (FLAGS)              BIND_NOW
> >> >  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
> >> >
> >> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> >> >
> >> > c++tools/ChangeLog:
> >> >
> >> > 	* configure.ac (--enable-host-bind-now): New check.
> >> > 	* configure: Regenerate.
> >> >
> >> > gcc/ChangeLog:
> >> >
> >> > 	* configure.ac (--enable-host-bind-now): New check.  Add
> >> > 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> >> > 	* configure: Regenerate.
> >> > 	* doc/install.texi: Document --enable-host-bind-now.
> >> >
> >> > lto-plugin/ChangeLog:
> >> >
> >> > 	* configure.ac (--enable-host-bind-now): New check.  Link with
> >> > 	-z,now.
> >> > 	* configure: Regenerate.
> >> 
> >> Our reconfiguration checking script complains about a missing hunk in
> >> lto-plugin/Makefile.in:
> >> 
> >> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
> >> index cb568e1e09f..f6f5b020ff5 100644
> >> --- a/lto-plugin/Makefile.in
> >> +++ b/lto-plugin/Makefile.in
> >> @@ -298,6 +298,7 @@ datadir = @datadir@
> >>  datarootdir = @datarootdir@
> >>  docdir = @docdir@
> >>  dvidir = @dvidir@
> >> +enable_host_bind_now = @enable_host_bind_now@
> >>  exec_prefix = @exec_prefix@
> >>  gcc_build_dir = @gcc_build_dir@
> >>  get_gcc_base_ver = @get_gcc_base_ver@
> >> 
> >> 
> >> I am somewhat puzzled why the line is not missing in any of the other
> >> Makefile.in files.  Can you please check whether that is the only thing
> >> that is missing (assuming it is actually missing)?
> >
> > Arg, once again, I'm sorry.  I don't know how this happened.  It would
> > be trivial to fix it but since
> >
> > commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> > Author: Eric Botcazou <ebotcazou@adacore.com>
> > Date:   Wed Jun 21 18:19:36 2023 +0200
> >
> >     ada: Fix build of GNAT tools
> >
> > the build with Ada included fails with --enable-host-pie.  So that needs
> > to be fixed first.
> >
> > Eric, I'm not asking you to fix that, but I'm curious, what did the
> > commit above fix?  The patch looks correct; I'm just puzzled why I
> > hadn't seen any build failures.
> >
> > The --enable-host-pie patch has been a nightmare :(.
> >
> 
> No worries, I can see how these things can easily get difficult.
> 
> Unfortunately I won't have time to actually look at this in the next 2-3
> weeks, so I am inclined to just trust the verification script (which
> essentially runs autoconf/automake everywhere and then expects no diff)
> and commit the one-line change.  What do you think, does that make sense
> (even without looking at why other Makefile.in files did not change)?

Yes please, go ahead with the one line change meanwhile.  Thanks!

I've opened PR110467 for the build problem.

Marek


^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-06-27 15:31   ` Marek Polacek
  2023-06-27 15:50     ` Iain Sandoe
  2023-06-27 17:06     ` Eric Botcazou
@ 2023-06-29 15:58     ` Martin Jambor
  2023-06-29 16:13       ` Marek Polacek
  2 siblings, 1 reply; 11+ messages in thread
From: Martin Jambor @ 2023-06-29 15:58 UTC (permalink / raw)
  To: Marek Polacek, Eric Botcazou; +Cc: GCC Patches

Hi,

On Tue, Jun 27 2023, Marek Polacek wrote:
> On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
>> Hello,
>> 
>> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
>> > As promised in the --enable-host-pie patch, this patch adds another
>> > configure option, --enable-host-bind-now, which adds -z now when linking
>> > the compiler executables in order to extend hardening.  BIND_NOW with RELRO
>> > allows the GOT to be marked RO; this prevents GOT modification attacks.
>> >
>> > This option does not affect linking of target libraries; you can use
>> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>> >
>> > With this patch:
>> > $ readelf -Wd cc1{,plus} | grep FLAGS
>> >  0x000000000000001e (FLAGS)              BIND_NOW
>> >  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>> >  0x000000000000001e (FLAGS)              BIND_NOW
>> >  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>> >
>> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>> >
>> > c++tools/ChangeLog:
>> >
>> > 	* configure.ac (--enable-host-bind-now): New check.
>> > 	* configure: Regenerate.
>> >
>> > gcc/ChangeLog:
>> >
>> > 	* configure.ac (--enable-host-bind-now): New check.  Add
>> > 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
>> > 	* configure: Regenerate.
>> > 	* doc/install.texi: Document --enable-host-bind-now.
>> >
>> > lto-plugin/ChangeLog:
>> >
>> > 	* configure.ac (--enable-host-bind-now): New check.  Link with
>> > 	-z,now.
>> > 	* configure: Regenerate.
>> 
>> Our reconfiguration checking script complains about a missing hunk in
>> lto-plugin/Makefile.in:
>> 
>> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
>> index cb568e1e09f..f6f5b020ff5 100644
>> --- a/lto-plugin/Makefile.in
>> +++ b/lto-plugin/Makefile.in
>> @@ -298,6 +298,7 @@ datadir = @datadir@
>>  datarootdir = @datarootdir@
>>  docdir = @docdir@
>>  dvidir = @dvidir@
>> +enable_host_bind_now = @enable_host_bind_now@
>>  exec_prefix = @exec_prefix@
>>  gcc_build_dir = @gcc_build_dir@
>>  get_gcc_base_ver = @get_gcc_base_ver@
>> 
>> 
>> I am somewhat puzzled why the line is not missing in any of the other
>> Makefile.in files.  Can you please check whether that is the only thing
>> that is missing (assuming it is actually missing)?
>
> Arg, once again, I'm sorry.  I don't know how this happened.  It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date:   Wed Jun 21 18:19:36 2023 +0200
>
>     ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie.  So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix?  The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
>
> The --enable-host-pie patch has been a nightmare :(.
>

No worries, I can see how these things can easily get difficult.

Unfortunately I won't have time to actually look at this in the next 2-3
weeks, so I am inclined to just trust the verification script (which
essentially runs autoconf/automake everywhere and then expects no diff)
and commit the one-line change.  What do you think, does that make sense
(even without looking at why other Makefile.in files did not change)?

Thanks,

Martin

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-06-27 15:31   ` Marek Polacek
  2023-06-27 15:50     ` Iain Sandoe
@ 2023-06-27 17:06     ` Eric Botcazou
  2023-06-29 15:58     ` Martin Jambor
  2 siblings, 0 replies; 11+ messages in thread
From: Eric Botcazou @ 2023-06-27 17:06 UTC (permalink / raw)
  To: Marek Polacek; +Cc: Martin Jambor, gcc-patches, GCC Patches

> Arg, once again, I'm sorry.  I don't know how this happened.  It would
> be trivial to fix it but since
> 
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date:   Wed Jun 21 18:19:36 2023 +0200
> 
>     ada: Fix build of GNAT tools
> 
> the build with Ada included fails with --enable-host-pie.  So that needs
> to be fixed first.
> 
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix?  The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.

The GNAT tools were failing to build for a compiler configured with --disable-
host-pie --enable-default-pie.

-- 
Eric Botcazou



^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-06-27 15:31   ` Marek Polacek
@ 2023-06-27 15:50     ` Iain Sandoe
  2023-06-27 17:06     ` Eric Botcazou
  2023-06-29 15:58     ` Martin Jambor
  2 siblings, 0 replies; 11+ messages in thread
From: Iain Sandoe @ 2023-06-27 15:50 UTC (permalink / raw)
  To: Eric Botcazou; +Cc: Martin Jambor, GCC Patches, Marek Polacek



> On 27 Jun 2023, at 16:31, Marek Polacek via Gcc-patches <gcc-patches@gcc.gnu.org> wrote:
> 
> On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
>> Hello,
>> 
>> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
>>> As promised in the --enable-host-pie patch, this patch adds another
>>> configure option, --enable-host-bind-now, which adds -z now when linking
>>> the compiler executables in order to extend hardening.  BIND_NOW with RELRO
>>> allows the GOT to be marked RO; this prevents GOT modification attacks.
>>> 
>>> This option does not affect linking of target libraries; you can use
>>> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>>> 
>>> With this patch:
>>> $ readelf -Wd cc1{,plus} | grep FLAGS
>>> 0x000000000000001e (FLAGS)              BIND_NOW
>>> 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>>> 0x000000000000001e (FLAGS)              BIND_NOW
>>> 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>>> 
>>> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>>> 
>>> c++tools/ChangeLog:
>>> 
>>> 	* configure.ac (--enable-host-bind-now): New check.
>>> 	* configure: Regenerate.
>>> 
>>> gcc/ChangeLog:
>>> 
>>> 	* configure.ac (--enable-host-bind-now): New check.  Add
>>> 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
>>> 	* configure: Regenerate.
>>> 	* doc/install.texi: Document --enable-host-bind-now.
>>> 
>>> lto-plugin/ChangeLog:
>>> 
>>> 	* configure.ac (--enable-host-bind-now): New check.  Link with
>>> 	-z,now.
>>> 	* configure: Regenerate.
>> 
>> Our reconfiguration checking script complains about a missing hunk in
>> lto-plugin/Makefile.in:
>> 
>> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
>> index cb568e1e09f..f6f5b020ff5 100644
>> --- a/lto-plugin/Makefile.in
>> +++ b/lto-plugin/Makefile.in
>> @@ -298,6 +298,7 @@ datadir = @datadir@
>> datarootdir = @datarootdir@
>> docdir = @docdir@
>> dvidir = @dvidir@
>> +enable_host_bind_now = @enable_host_bind_now@
>> exec_prefix = @exec_prefix@
>> gcc_build_dir = @gcc_build_dir@
>> get_gcc_base_ver = @get_gcc_base_ver@
>> 
>> 
>> I am somewhat puzzled why the line is not missing in any of the other
>> Makefile.in files.  Can you please check whether that is the only thing
>> that is missing (assuming it is actually missing)?
> 
> Arg, once again, I'm sorry.  I don't know how this happened.  It would
> be trivial to fix it but since
> 
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date:   Wed Jun 21 18:19:36 2023 +0200
> 
>    ada: Fix build of GNAT tools
> 
> the build with Ada included fails with --enable-host-pie.  So that needs
> to be fixed first.
> 
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix?  The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.

I am also curious as to why we do not need some logic to do a similar job
in gcc-interface/Make-lang.in:

ifeq ($(STAGE1),True)
  ADA_INCLUDES=$(COMMON_ADA_INCLUDES)
  adalib=$(dir $(shell $(CC) -print-libgcc-file-name))adalib
  GNATLIB=$(adalib)/$(if $(wildcard $(adalib)/libgnat.a), libgnat.a,libgnat.so) $(STAGE1_LIBS)
else

^^^ I would expect us to need to switch to libgnat_pic.a when we are building a PIE exe.

Iain

> The --enable-host-pie patch has been a nightmare :(.
> 
> Marek


^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-06-27 11:39 ` Martin Jambor
@ 2023-06-27 15:31   ` Marek Polacek
  2023-06-27 15:50     ` Iain Sandoe
                       ` (2 more replies)
  0 siblings, 3 replies; 11+ messages in thread
From: Marek Polacek @ 2023-06-27 15:31 UTC (permalink / raw)
  To: Martin Jambor, Eric Botcazou; +Cc: GCC Patches

On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
> Hello,
> 
> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> > As promised in the --enable-host-pie patch, this patch adds another
> > configure option, --enable-host-bind-now, which adds -z now when linking
> > the compiler executables in order to extend hardening.  BIND_NOW with RELRO
> > allows the GOT to be marked RO; this prevents GOT modification attacks.
> >
> > This option does not affect linking of target libraries; you can use
> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> >
> > With this patch:
> > $ readelf -Wd cc1{,plus} | grep FLAGS
> >  0x000000000000001e (FLAGS)              BIND_NOW
> >  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
> >  0x000000000000001e (FLAGS)              BIND_NOW
> >  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
> >
> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> >
> > c++tools/ChangeLog:
> >
> > 	* configure.ac (--enable-host-bind-now): New check.
> > 	* configure: Regenerate.
> >
> > gcc/ChangeLog:
> >
> > 	* configure.ac (--enable-host-bind-now): New check.  Add
> > 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> > 	* configure: Regenerate.
> > 	* doc/install.texi: Document --enable-host-bind-now.
> >
> > lto-plugin/ChangeLog:
> >
> > 	* configure.ac (--enable-host-bind-now): New check.  Link with
> > 	-z,now.
> > 	* configure: Regenerate.
> 
> Our reconfiguration checking script complains about a missing hunk in
> lto-plugin/Makefile.in:
> 
> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
> index cb568e1e09f..f6f5b020ff5 100644
> --- a/lto-plugin/Makefile.in
> +++ b/lto-plugin/Makefile.in
> @@ -298,6 +298,7 @@ datadir = @datadir@
>  datarootdir = @datarootdir@
>  docdir = @docdir@
>  dvidir = @dvidir@
> +enable_host_bind_now = @enable_host_bind_now@
>  exec_prefix = @exec_prefix@
>  gcc_build_dir = @gcc_build_dir@
>  get_gcc_base_ver = @get_gcc_base_ver@
> 
> 
> I am somewhat puzzled why the line is not missing in any of the other
> Makefile.in files.  Can you please check whether that is the only thing
> that is missing (assuming it is actually missing)?

Arg, once again, I'm sorry.  I don't know how this happened.  It would
be trivial to fix it but since

commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
Author: Eric Botcazou <ebotcazou@adacore.com>
Date:   Wed Jun 21 18:19:36 2023 +0200

    ada: Fix build of GNAT tools

the build with Ada included fails with --enable-host-pie.  So that needs
to be fixed first.

Eric, I'm not asking you to fix that, but I'm curious, what did the
commit above fix?  The patch looks correct; I'm just puzzled why I
hadn't seen any build failures.

The --enable-host-pie patch has been a nightmare :(.

Marek


^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-05-16 15:37 Marek Polacek
  2023-05-19 21:29 ` Jeff Law
@ 2023-06-27 11:39 ` Martin Jambor
  2023-06-27 15:31   ` Marek Polacek
  1 sibling, 1 reply; 11+ messages in thread
From: Martin Jambor @ 2023-06-27 11:39 UTC (permalink / raw)
  To: Marek Polacek; +Cc: GCC Patches

Hello,

On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening.  BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> With this patch:
> $ readelf -Wd cc1{,plus} | grep FLAGS
>  0x000000000000001e (FLAGS)              BIND_NOW
>  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>  0x000000000000001e (FLAGS)              BIND_NOW
>  0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> c++tools/ChangeLog:
>
> 	* configure.ac (--enable-host-bind-now): New check.
> 	* configure: Regenerate.
>
> gcc/ChangeLog:
>
> 	* configure.ac (--enable-host-bind-now): New check.  Add
> 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> 	* configure: Regenerate.
> 	* doc/install.texi: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> 	* configure.ac (--enable-host-bind-now): New check.  Link with
> 	-z,now.
> 	* configure: Regenerate.

Our reconfiguration checking script complains about a missing hunk in
lto-plugin/Makefile.in:

diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
index cb568e1e09f..f6f5b020ff5 100644
--- a/lto-plugin/Makefile.in
+++ b/lto-plugin/Makefile.in
@@ -298,6 +298,7 @@ datadir = @datadir@
 datarootdir = @datarootdir@
 docdir = @docdir@
 dvidir = @dvidir@
+enable_host_bind_now = @enable_host_bind_now@
 exec_prefix = @exec_prefix@
 gcc_build_dir = @gcc_build_dir@
 get_gcc_base_ver = @get_gcc_base_ver@


I am somewhat puzzled why the line is not missing in any of the other
Makefile.in files.  Can you please check whether that is the only thing
that is missing (assuming it is actually missing)?

Thanks,

Martin

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] configure: Implement --enable-host-bind-now
  2023-05-16 15:37 Marek Polacek
@ 2023-05-19 21:29 ` Jeff Law
  2023-06-27 11:39 ` Martin Jambor
  1 sibling, 0 replies; 11+ messages in thread
From: Jeff Law @ 2023-05-19 21:29 UTC (permalink / raw)
  To: Marek Polacek, GCC Patches



On 5/16/23 09:37, Marek Polacek via Gcc-patches wrote:
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening.  BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
> 
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> 
> With this patch:
> $ readelf -Wd cc1{,plus} | grep FLAGS
>   0x000000000000001e (FLAGS)              BIND_NOW
>   0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
>   0x000000000000001e (FLAGS)              BIND_NOW
>   0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
> 
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> 
> c++tools/ChangeLog:
> 
> 	* configure.ac (--enable-host-bind-now): New check.
> 	* configure: Regenerate.
> 
> gcc/ChangeLog:
> 
> 	* configure.ac (--enable-host-bind-now): New check.  Add
> 	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> 	* configure: Regenerate.
> 	* doc/install.texi: Document --enable-host-bind-now.
> 
> lto-plugin/ChangeLog:
> 
> 	* configure.ac (--enable-host-bind-now): New check.  Link with
> 	-z,now.
> 	* configure: Regenerate.
OK
jeff

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH] configure: Implement --enable-host-bind-now
@ 2023-05-16 15:37 Marek Polacek
  2023-05-19 21:29 ` Jeff Law
  2023-06-27 11:39 ` Martin Jambor
  0 siblings, 2 replies; 11+ messages in thread
From: Marek Polacek @ 2023-05-16 15:37 UTC (permalink / raw)
  To: GCC Patches

As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening.  BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.

This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.

With this patch:
$ readelf -Wd cc1{,plus} | grep FLAGS
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE

Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?

c++tools/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.
	* configure: Regenerate.

gcc/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Add
	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
	* configure: Regenerate.
	* doc/install.texi: Document --enable-host-bind-now.

lto-plugin/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Link with
	-z,now.
	* configure: Regenerate.

diff --git a/c++tools/configure b/c++tools/configure
index 88087009383..006efe07b35 100755
--- a/c++tools/configure
+++ b/c++tools/configure
@@ -628,6 +628,7 @@ EGREP
 GREP
 CXXCPP
 LD_PICFLAG
+enable_host_bind_now
 PICFLAG
 MAINTAINER
 CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
 enable_checking
 enable_default_pie
 enable_host_pie
+enable_host_bind_now
 with_gcc_major_version_only
 '
       ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
                           yes,no,all,none,release.
   --enable-default-pie    enable Position Independent Executable as default
   --enable-host-pie       build host code as PIE
+  --enable-host-bind-now  link host code as BIND_NOW
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
 
 
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
 
 # Check if O_CLOEXEC is defined by fcntl
 
diff --git a/c++tools/configure.ac b/c++tools/configure.ac
index 44dfaccbbfa..c2a16601425 100644
--- a/c++tools/configure.ac
+++ b/c++tools/configure.ac
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
 		[build host code as PIE])],
 [PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
 AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+       [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
 AC_SUBST(LD_PICFLAG)
 
 # Check if O_CLOEXEC is defined by fcntl
diff --git a/gcc/configure b/gcc/configure
index 629446ecf3b..6d847c60024 100755
--- a/gcc/configure
+++ b/gcc/configure
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
 LD_PICFLAG
 PICFLAG
 enable_default_pie
+enable_host_bind_now
 enable_host_pie
 enable_host_shared
 enable_plugin
@@ -1031,6 +1032,7 @@ enable_version_specific_runtime_libs
 enable_plugin
 enable_host_shared
 enable_host_pie
+enable_host_bind_now
 enable_libquadmath_support
 with_linker_hash_style
 with_diagnostics_color
@@ -1794,6 +1796,7 @@ Optional Features:
   --enable-plugin         enable plugin support
   --enable-host-shared    build host code as shared libraries
   --enable-host-pie       build host code as PIE
+  --enable-host-bind-now  link host code as BIND_NOW
   --disable-libquadmath-support
                           disable libquadmath support for Fortran
   --enable-default-pie    enable Position Independent Executable as default
@@ -19852,7 +19855,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 19867 "configure"
+#line 19870 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -19958,7 +19961,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 19973 "configure"
+#line 19976 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -32105,6 +32108,14 @@ fi
 
 
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now;
+fi
+
+
+
 # Check whether --enable-libquadmath-support was given.
 if test "${enable_libquadmath_support+set}" = set; then :
   enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32291,6 +32302,8 @@ else
   PICFLAG=
 fi
 
+
+
 if test x$enable_host_pie = xyes; then
   LD_PICFLAG=-pie
 elif test x$gcc_cv_no_pie = xyes; then
@@ -32299,6 +32312,9 @@ else
   LD_PICFLAG=
 fi
 
+if test x$enable_host_bind_now = xyes; then
+  LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
 
 
 
diff --git a/gcc/configure.ac b/gcc/configure.ac
index 9c69a55668e..f0d56e0eaf0 100644
--- a/gcc/configure.ac
+++ b/gcc/configure.ac
@@ -7427,6 +7427,12 @@ AC_ARG_ENABLE(host-pie,
 		[build host code as PIE])])
 AC_SUBST(enable_host_pie)
 
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+		[link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
 AC_ARG_ENABLE(libquadmath-support,
 [AS_HELP_STRING([--disable-libquadmath-support],
   [disable libquadmath support for Fortran])],
@@ -7568,6 +7574,8 @@ else
   PICFLAG=
 fi
 
+AC_SUBST([PICFLAG])
+
 if test x$enable_host_pie = xyes; then
   LD_PICFLAG=-pie
 elif test x$gcc_cv_no_pie = xyes; then
@@ -7576,7 +7584,10 @@ else
   LD_PICFLAG=
 fi
 
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+  LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
 AC_SUBST([LD_PICFLAG])
 
 # Enable Intel CET on Intel CET enabled host if jit is enabled.
diff --git a/gcc/doc/install.texi b/gcc/doc/install.texi
index 2248308dbdf..a840d36bd6d 100644
--- a/gcc/doc/install.texi
+++ b/gcc/doc/install.texi
@@ -1092,6 +1092,12 @@ protection against Return Oriented Programming (ROP) attacks.
 in which case @option{-fPIC} is used when compiling, and @option{-pie} when
 linking.
 
+@item --enable-host-bind-now
+Specify that the @emph{host} executables should be linked with the option
+@option{-Wl,-z,now}, which means that the dynamic linker will resolve all
+symbols when the executables are started, and that in turn allows RELRO to
+mark the GOT read-only, resulting in better security.
+
 @item @anchor{with-gnu-as}--with-gnu-as
 Specify that the compiler should assume that the
 assembler it finds is the GNU assembler.  However, this does not modify
diff --git a/lto-plugin/configure b/lto-plugin/configure
index d522bd24c95..3467defd416 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -663,6 +663,7 @@ accel_dir_suffix
 gcc_build_dir
 CET_HOST_FLAGS
 ac_lto_plugin_ldflags
+enable_host_bind_now
 ac_lto_plugin_warn_cflags
 EGREP
 GREP
@@ -778,6 +779,7 @@ enable_maintainer_mode
 with_libiberty
 enable_dependency_tracking
 enable_largefile
+enable_host_bind_now
 enable_cet
 with_gcc_major_version_only
 enable_shared
@@ -1425,6 +1427,7 @@ Optional Features:
   --disable-dependency-tracking
                           speeds up one-time build
   --disable-largefile     omit support for large files
+  --enable-host-bind-now  link host code as BIND_NOW
   --enable-cet            enable Intel CET in host libraries [default=auto]
   --enable-shared[=PKGS]  build shared libraries [default=yes]
   --enable-static[=PKGS]  build static libraries [default=yes]
@@ -5669,6 +5672,19 @@ if test "x$have_static_libgcc" = xyes; then
    ac_lto_plugin_ldflags="-Wc,-static-libgcc"
 fi
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+  ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
 
  # Check whether --enable-cet was given.
 if test "${enable_cet+set}" = set; then :
@@ -12134,7 +12150,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12137 "configure"
+#line 12165 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12240,7 +12256,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12243 "configure"
+#line 12271 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac
index 0a7202782ae..84f2a60b480 100644
--- a/lto-plugin/configure.ac
+++ b/lto-plugin/configure.ac
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
 if test "x$have_static_libgcc" = xyes; then
    ac_lto_plugin_ldflags="-Wc,-static-libgcc"
 fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+       [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+  ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
 AC_SUBST(ac_lto_plugin_ldflags)
 
 GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)


^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH] configure: Implement --enable-host-bind-now
@ 2022-02-10 16:50 Marek Polacek
  0 siblings, 0 replies; 11+ messages in thread
From: Marek Polacek @ 2022-02-10 16:50 UTC (permalink / raw)
  To: GCC Patches; +Cc: Alexandre Oliva, Paolo Bonzini, Joseph Myers, Jakub Jelinek

As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening.  BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.

This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.

Bootstrapped/regtested on x86_64-pc-linux-gnu (with the option enabled vs
not enabled).  I suppose this is GCC 13 material, but maybe I'll get some
comments anyway.

c++tools/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.
	* configure: Regenerate.

gcc/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Add
	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
	* configure: Regenerate.
	* doc/install.texi: Document --enable-host-bind-now.

lto-plugin/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Link with
	-z,now.
	* configure: Regenerate.
---
 c++tools/configure      | 11 +++++++++++
 c++tools/configure.ac   |  7 +++++++
 gcc/configure           | 20 ++++++++++++++++++--
 gcc/configure.ac        | 13 ++++++++++++-
 gcc/doc/install.texi    |  6 ++++++
 lto-plugin/configure    | 20 ++++++++++++++++++--
 lto-plugin/configure.ac | 11 +++++++++++
 7 files changed, 83 insertions(+), 5 deletions(-)

diff --git a/c++tools/configure b/c++tools/configure
index 88087009383..006efe07b35 100755
--- a/c++tools/configure
+++ b/c++tools/configure
@@ -628,6 +628,7 @@ EGREP
 GREP
 CXXCPP
 LD_PICFLAG
+enable_host_bind_now
 PICFLAG
 MAINTAINER
 CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
 enable_checking
 enable_default_pie
 enable_host_pie
+enable_host_bind_now
 with_gcc_major_version_only
 '
       ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
                           yes,no,all,none,release.
   --enable-default-pie    enable Position Independent Executable as default
   --enable-host-pie       build host code as PIE
+  --enable-host-bind-now  link host code as BIND_NOW
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
 
 
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
 
 # Check if O_CLOEXEC is defined by fcntl
 
diff --git a/c++tools/configure.ac b/c++tools/configure.ac
index 1e42689f2eb..d3f23f66f00 100644
--- a/c++tools/configure.ac
+++ b/c++tools/configure.ac
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
 		[build host code as PIE])],
 [PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
 AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+       [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
 AC_SUBST(LD_PICFLAG)
 
 # Check if O_CLOEXEC is defined by fcntl
diff --git a/gcc/configure b/gcc/configure
index bd4fe1fd6ca..70156b17a40 100755
--- a/gcc/configure
+++ b/gcc/configure
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
 LD_PICFLAG
 PICFLAG
 enable_default_pie
+enable_host_bind_now
 enable_host_pie
 enable_host_shared
 enable_plugin
@@ -1026,6 +1027,7 @@ enable_version_specific_runtime_libs
 enable_plugin
 enable_host_shared
 enable_host_pie
+enable_host_bind_now
 enable_libquadmath_support
 with_linker_hash_style
 with_diagnostics_color
@@ -1789,6 +1791,7 @@ Optional Features:
   --enable-plugin         enable plugin support
   --enable-host-shared    build host code as shared libraries
   --enable-host-pie       build host code as PIE
+  --enable-host-bind-now  link host code as BIND_NOW
   --disable-libquadmath-support
                           disable libquadmath support for Fortran
   --enable-default-pie    enable Position Independent Executable as default
@@ -19661,7 +19664,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 19676 "configure"
+#line 19679 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -19767,7 +19770,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 19782 "configure"
+#line 19785 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -32236,6 +32239,14 @@ fi
 
 
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now;
+fi
+
+
+
 # Check whether --enable-libquadmath-support was given.
 if test "${enable_libquadmath_support+set}" = set; then :
   enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32422,6 +32433,8 @@ else
   PICFLAG=
 fi
 
+
+
 if test x$enable_host_pie = xyes; then
   LD_PICFLAG=-pie
 elif test x$gcc_cv_no_pie = xyes; then
@@ -32430,6 +32443,9 @@ else
   LD_PICFLAG=
 fi
 
+if test x$enable_host_bind_now = xyes; then
+  LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
 
 
 
diff --git a/gcc/configure.ac b/gcc/configure.ac
index dca995aeec7..6017bcbc8c6 100644
--- a/gcc/configure.ac
+++ b/gcc/configure.ac
@@ -7497,6 +7497,12 @@ AC_ARG_ENABLE(host-pie,
 		[build host code as PIE])])
 AC_SUBST(enable_host_pie)
 
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+		[link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
 AC_ARG_ENABLE(libquadmath-support,
 [AS_HELP_STRING([--disable-libquadmath-support],
   [disable libquadmath support for Fortran])],
@@ -7638,6 +7644,8 @@ else
   PICFLAG=
 fi
 
+AC_SUBST([PICFLAG])
+
 if test x$enable_host_pie = xyes; then
   LD_PICFLAG=-pie
 elif test x$gcc_cv_no_pie = xyes; then
@@ -7646,7 +7654,10 @@ else
   LD_PICFLAG=
 fi
 
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+  LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
 AC_SUBST([LD_PICFLAG])
 
 # Enable Intel CET on Intel CET enabled host if jit is enabled.
diff --git a/gcc/doc/install.texi b/gcc/doc/install.texi
index 9747f832a75..b59af198d3e 100644
--- a/gcc/doc/install.texi
+++ b/gcc/doc/install.texi
@@ -1041,6 +1041,12 @@ protection against Return Oriented Programming (ROP) attacks.
 in which case @option{-fPIC} is used when compiling, and @option{-pie} when
 linking.
 
+@item --enable-host-bind-now
+Specify that the @emph{host} executables should be linked with the option
+@option{-Wl,-z,now}, which means that the dynamic linker will resolve all
+symbols when the executables are started, and that in turn allows RELRO to
+mark the GOT read-only, resulting in better security.
+
 @item @anchor{with-gnu-as}--with-gnu-as
 Specify that the compiler should assume that the
 assembler it finds is the GNU assembler.  However, this does not modify
diff --git a/lto-plugin/configure b/lto-plugin/configure
index 26aad9dd699..f8e29e92ed7 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -656,6 +656,7 @@ accel_dir_suffix
 gcc_build_dir
 CET_HOST_FLAGS
 ac_lto_plugin_ldflags
+enable_host_bind_now
 ac_lto_plugin_warn_cflags
 EGREP
 GREP
@@ -771,6 +772,7 @@ enable_maintainer_mode
 with_libiberty
 enable_dependency_tracking
 enable_largefile
+enable_host_bind_now
 enable_cet
 with_gcc_major_version_only
 enable_shared
@@ -1418,6 +1420,7 @@ Optional Features:
   --disable-dependency-tracking
                           speeds up one-time build
   --disable-largefile     omit support for large files
+  --enable-host-bind-now  link host code as BIND_NOW
   --enable-cet            enable Intel CET in host libraries [default=auto]
   --enable-shared[=PKGS]  build shared libraries [default=yes]
   --enable-static[=PKGS]  build static libraries [default=yes]
@@ -5662,6 +5665,19 @@ if test "x$have_static_libgcc" = xyes; then
    ac_lto_plugin_ldflags="-Wc,-static-libgcc"
 fi
 
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+  enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+  ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
 
  # Check whether --enable-cet was given.
 if test "${enable_cet+set}" = set; then :
@@ -11981,7 +11997,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 11984 "configure"
+#line 12012 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12087,7 +12103,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12090 "configure"
+#line 12118 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac
index 7e6f729e9dc..5d5fea8fe70 100644
--- a/lto-plugin/configure.ac
+++ b/lto-plugin/configure.ac
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
 if test "x$have_static_libgcc" = xyes; then
    ac_lto_plugin_ldflags="-Wc,-static-libgcc"
 fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+       [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+  ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
 AC_SUBST(ac_lto_plugin_ldflags)
 
 GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)

base-commit: bf799d3409cb9a189114a6c9ff5b7cd123915764
-- 
2.34.1


^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2023-06-29 16:13 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-11  2:53 [PATCH] configure: Implement --enable-host-bind-now Marek Polacek
2022-11-20 15:09 ` Jeff Law
  -- strict thread matches above, loose matches on Subject: below --
2023-05-16 15:37 Marek Polacek
2023-05-19 21:29 ` Jeff Law
2023-06-27 11:39 ` Martin Jambor
2023-06-27 15:31   ` Marek Polacek
2023-06-27 15:50     ` Iain Sandoe
2023-06-27 17:06     ` Eric Botcazou
2023-06-29 15:58     ` Martin Jambor
2023-06-29 16:13       ` Marek Polacek
2022-02-10 16:50 Marek Polacek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).