|
 |
14f0285 |
From 1df0a74f88f044f1e538e3d4fda13bbceb76e68b Mon Sep 17 00:00:00 2001
|
|
|
14f0285 |
From: Robbie Harwood <rharwood@redhat.com>
|
|
|
14f0285 |
Date: Tue, 23 Aug 2016 16:45:26 -0400
|
|
|
32ef372 |
Subject: [PATCH] krb5-1.12-buildconf.patch
|
|
|
14f0285 |
|
|
Nalin Dahyabhai |
2202e37 |
Build binaries in this package as RELRO PIEs, libraries as partial RELRO,
|
|
Nalin Dahyabhai |
2202e37 |
and install shared libraries with the execute bit set on them. Prune out
|
|
Nalin Dahyabhai |
0fde11f |
the -L/usr/lib* and PIE flags where they might leak out and affect
|
|
Nalin Dahyabhai |
2202e37 |
apps which just want to link with the libraries. FIXME: needs to check and
|
|
Nalin Dahyabhai |
2202e37 |
not just assume that the compiler supports using these flags.
|
|
|
14f0285 |
---
|
|
|
14f0285 |
src/build-tools/krb5-config.in | 7 +++++++
|
|
|
14f0285 |
src/config/pre.in | 2 +-
|
|
|
14f0285 |
src/config/shlib.conf | 5 +++--
|
|
|
14f0285 |
3 files changed, 11 insertions(+), 3 deletions(-)
|
|
 |
d067ec2 |
|
|
|
14f0285 |
diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
|
|
|
14f0285 |
index c17cb5e..1891dea 100755
|
|
|
14f0285 |
--- a/src/build-tools/krb5-config.in
|
|
|
14f0285 |
+++ b/src/build-tools/krb5-config.in
|
|
|
14f0285 |
@@ -226,6 +226,13 @@ if test -n "$do_libs"; then
|
|
|
d067ec2 |
-e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
|
|
Nalin Dahyabhai |
0fde11f |
-e 's#\$(CFLAGS)##'`
|
|
|
d067ec2 |
|
|
|
d067ec2 |
+ if test `dirname $libdir` = /usr ; then
|
|
|
d067ec2 |
+ lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"`
|
|
|
d067ec2 |
+ fi
|
|
Nalin Dahyabhai |
2202e37 |
+ lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"`
|
|
Nalin Dahyabhai |
2202e37 |
+ lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"`
|
|
Nalin Dahyabhai |
2202e37 |
+ lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"`
|
|
|
d067ec2 |
+
|
|
|
d067ec2 |
if test $library = 'kdb'; then
|
|
|
d067ec2 |
lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB"
|
|
|
d067ec2 |
library=krb5
|
|
|
14f0285 |
diff --git a/src/config/pre.in b/src/config/pre.in
|
|
|
14f0285 |
index 63271e7..c100fef 100644
|
|
|
14f0285 |
--- a/src/config/pre.in
|
|
|
14f0285 |
+++ b/src/config/pre.in
|
|
|
14f0285 |
@@ -182,7 +182,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
|
|
Nalin Dahyabhai |
2ee39c5 |
INSTALL_SCRIPT=@INSTALL_PROGRAM@
|
|
Nalin Dahyabhai |
2ee39c5 |
INSTALL_DATA=@INSTALL_DATA@
|
|
Nalin Dahyabhai |
2ee39c5 |
INSTALL_SHLIB=@INSTALL_SHLIB@
|
|
Nalin Dahyabhai |
2ee39c5 |
-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
|
|
Nalin Dahyabhai |
2ee39c5 |
+INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755
|
|
Nalin Dahyabhai |
2ee39c5 |
## This is needed because autoconf will sometimes define @exec_prefix@ to be
|
|
Nalin Dahyabhai |
2ee39c5 |
## ${prefix}.
|
|
Nalin Dahyabhai |
2ee39c5 |
prefix=@prefix@
|
|
|
14f0285 |
diff --git a/src/config/shlib.conf b/src/config/shlib.conf
|
|
|
14f0285 |
index 55f16be..f4a762c 100644
|
|
|
14f0285 |
--- a/src/config/shlib.conf
|
|
|
14f0285 |
+++ b/src/config/shlib.conf
|
|
|
14f0285 |
@@ -422,7 +422,7 @@ mips-*-netbsd*)
|
|
|
14f0285 |
SHLIBEXT=.so
|
|
|
14f0285 |
# Linux ld doesn't default to stuffing the SONAME field...
|
|
|
14f0285 |
# Use objdump -x to examine the fields of the library
|
|
|
14f0285 |
- LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT),--no-undefined'
|
|
|
14f0285 |
+ LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT),--no-undefined -Wl,-z,relro -Wl,--warn-shared-textrel'
|
|
|
14f0285 |
#
|
|
|
14f0285 |
LDCOMBINE_TAIL='-Wl,--version-script binutils.versions && $(PERL) -w $(top_srcdir)/util/export-check.pl $(SHLIB_EXPORT_FILE) $@'
|
|
|
14f0285 |
SHLIB_EXPORT_FILE_DEP=binutils.versions
|
|
|
14f0285 |
@@ -433,7 +433,8 @@ mips-*-netbsd*)
|
|
|
14f0285 |
SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
|
|
|
14f0285 |
PROFFLAGS=-pg
|
|
|
14f0285 |
PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
|
|
|
14f0285 |
- CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
|
|
|
14f0285 |
+ CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)'
|
|
|
14f0285 |
+ INSTALL_SHLIB='${INSTALL} -m755'
|
|
|
14f0285 |
CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
|
|
|
14f0285 |
CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
|
|
|
14f0285 |
CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'
|
|
|
14f0285 |
--
|
|
|
14f0285 |
2.9.3
|
|
|
14f0285 |
|