From e3a844a5558c2609f702e20d5b4a09b6204bff95 Mon Sep 17 00:00:00 2001
From: Jiri Popelka <jpopelka@redhat.com>
Date: Sep 07 2010 15:38:08 +0000
Subject: Hardening dhcpd/dhcrelay/dhclient by making them PIE & RELRO


---

diff --git a/dhcp-4.1.1-P1-PIE-RELRO.patch b/dhcp-4.1.1-P1-PIE-RELRO.patch
new file mode 100644
index 0000000..e8f394f
--- /dev/null
+++ b/dhcp-4.1.1-P1-PIE-RELRO.patch
@@ -0,0 +1,35 @@
+diff -up dhcp-4.1.1-P1/client/Makefile.am.PIE-RELRO dhcp-4.1.1-P1/client/Makefile.am
+--- dhcp-4.1.1-P1/client/Makefile.am.PIE-RELRO	2010-09-03 16:52:34.000000000 +0200
++++ dhcp-4.1.1-P1/client/Makefile.am	2010-09-03 16:54:45.193275762 +0200
+@@ -6,6 +6,8 @@ dhclient_SOURCES = clparse.c dhclient.c 
+ 		   scripts/solaris scripts/openwrt
+ dhclient_LDADD = ../common/libdhcp.a ../minires/libres.a \
+ 		 ../omapip/libomapi.a ../dst/libdst.a $(CAPNG_LDADD)
++dhclient_LDFLAGS = -pie -Wl,-z,relro -Wl,-z,now
++
+ man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
+ EXTRA_DIST = $(man_MANS)
+ 
+diff -up dhcp-4.1.1-P1/relay/Makefile.am.PIE-RELRO dhcp-4.1.1-P1/relay/Makefile.am
+--- dhcp-4.1.1-P1/relay/Makefile.am.PIE-RELRO	2008-06-13 02:55:53.000000000 +0200
++++ dhcp-4.1.1-P1/relay/Makefile.am	2010-09-03 16:54:40.680276341 +0200
+@@ -3,6 +3,8 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
+ sbin_PROGRAMS = dhcrelay
+ dhcrelay_SOURCES = dhcrelay.c
+ dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dst/libdst.a ../minires/libres.a
++dhcrelay_LDFLAGS = -pie -Wl,-z,relro -Wl,-z,now
++
+ man_MANS = dhcrelay.8
+ EXTRA_DIST = $(man_MANS)
+ 
+diff -up dhcp-4.1.1-P1/server/Makefile.am.PIE-RELRO dhcp-4.1.1-P1/server/Makefile.am
+--- dhcp-4.1.1-P1/server/Makefile.am.PIE-RELRO	2010-09-03 16:52:33.014269279 +0200
++++ dhcp-4.1.1-P1/server/Makefile.am	2010-09-03 16:54:37.354284369 +0200
+@@ -9,6 +9,7 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
+ dhcpd_CFLAGS = $(LDAP_CFLAGS) $(LDAPSSL_CFLAGS)
+ dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../minires/libres.a \
+ 	      ../dhcpctl/libdhcpctl.a ../dst/libdst.a $(LDAP_LIBS)
++dhcpd_LDFLAGS = -pie -Wl,-z,relro -Wl,-z,now
+ 
+ man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
+ EXTRA_DIST = $(man_MANS)
diff --git a/dhcp.spec b/dhcp.spec
index a64cece..daa65f0 100644
--- a/dhcp.spec
+++ b/dhcp.spec
@@ -15,7 +15,7 @@
 Summary:  Dynamic host configuration protocol software
 Name:     dhcp
 Version:  4.1.1
-Release:  24.%{patchver}%{?dist}
+Release:  25.%{patchver}%{?dist}
 # NEVER CHANGE THE EPOCH on this package.  The previous maintainer (prior to
 # dcantrell maintaining the package) made incorrect use of the epoch and
 # that's why it is at 12 now.  It should have never been used, but it was.
@@ -62,6 +62,7 @@ Patch24:  %{name}-4.1.1-retransmission.patch
 Patch25:  %{name}-4.1.1-release6-elapsed.patch
 Patch26:  %{name}-4.1.1-initialization-delay.patch
 Patch27:  %{name}-4.1.1-P1-parse_date.patch
+Patch28:  %{name}-4.1.1-P1-PIE-RELRO.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: autoconf
@@ -243,6 +244,9 @@ libdhcpctl and libomapi static libraries are also included in this package.
 # (Submitted to dhcp-bugs@isc.org - [ISC-Bugs #21501])
 %patch27 -p1 -b .parse_date
 
+# Make dhcpd/dhcrelay/dhclient PIE and RELRO
+%patch28 -p1 -b .PIE-RELRO
+
 # Copy in documentation and example scripts for LDAP patch to dhcpd
 %{__install} -p -m 0755 ldap-for-dhcp-%{ldappatchver}/dhcpd-conf-to-ldap contrib/
 
@@ -302,7 +306,7 @@ autoheader
 automake --foreign --add-missing --copy
 
 %build
-CFLAGS="%{optflags} -fno-strict-aliasing -fPIC -D_GNU_SOURCE" \
+CFLAGS="%{optflags} -fno-strict-aliasing -fPIE -D_GNU_SOURCE" \
 %configure \
     --enable-dhcpv6 \
     --with-srv-lease-file=%{_localstatedir}/lib/dhcpd/dhcpd.leases \
@@ -528,6 +532,9 @@ fi
 %attr(0644,root,root) %{_mandir}/man3/omapi.3.gz
 
 %changelog
+* Tue Sep 07 2010 Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-25.P1
+- Hardening dhcpd/dhcrelay/dhclient by making them PIE & RELRO
+
 * Fri Aug 20 2010 Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-24.P1
 - Add DHCRELAYARGS variable to /etc/sysconfig/dhcrelay