Re: PING^N: [PATCH] Add --enable-static-pie to build static PIE [BZ #19574]

[Carlos O'Donell <carlos@redhat.com>]

On 12/15/2017 06:03 PM, H.J. Lu wrote:
> On Fri, Dec 15, 2017 at 1:19 PM, Carlos O'Donell <carlos@redhat.com> wrote:
>> On 12/01/2017 10:24 AM, H.J. Lu wrote:
>>> On Thu, Nov 30, 2017 at 1:44 PM, Carlos O'Donell <carlos@redhat.com> wrote:
>>>> H.J.,
>>>>
>>>> High Level:
>>>>
>>>> At a high level I have no objection with the idea of static PIE executables,
>>>> it makes sense to support such things.
>>> Thanks for your feedbacks.
>>
>> Thank you for putting together a v2, sorry it took me a while to review.
>>
>> This version looks good to me, it cleans up the outstanding issues with the
>> implementation, and you have answered my questions about testing in the design.
>> The firstword hack is removed in the implementation and that was the only thing
>> that needed cleanup.
>>
>> Looks good to me. Please feel free to commit.
> 
> Thanks for your time.  I checked it in with the updated commit log.
> I also updated
> 
> https://sourceware.org/glibc/wiki/PortStatus
> 
> for static PIE status.  Should build-many-glibcs.py be updated to also
> build static
> PIE for i386, x86_64 and x32?  We can't build it by default since the
> recent linker
> is needed.

It couldn't hurt to enable an extra build for i386, x86_64, and x32 with
static PIE, that way we get better coverage.

However, I defer this decision to Joseph Myers, if he thinks this would
add value without adding too much cost to the build, then I'm happy to see
it enabled.

Personally I think static PIE should *always* be used since it hardens
static executables in ways which are useful. Static executables should be
special tools which are always present on the system, and hardening them
from attack is important.

-- 
Cheers,
Carlos.