-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Control: tag -1 +help
Hello Balint, On Mon, 2016-09-12 at 16:42 +0200, Balint Reczey wrote: > During a rebuild of all packages in sid, your package failed to build on > amd64 with patched GCC and dpkg. > > The rebuild tested if packages are ready for a transition > enabling PIE and bindnow for amd64. > I have tried enabling hardening flags before but that never helped. And I did not look very deep into it. hardening=+all also modifies LDFLAGS which breaks the UML kernel build. So today, I tried with just the below, but lintian still complains. rrs@chutzpah:~/Community/Packaging/user-mode-linux (master)$ git diff diff --git a/debian/rules b/debian/rules index e29da82..802eb1e 100755 - --- a/debian/rules +++ b/debian/rules @@ -15,6 +15,10 @@ tmpmodules:=$(debian)/uml-modules DEB_HOST_ARCH?=$(shell dpkg-architecture -qDEB_HOST_ARCH) #SUBARCH?=$(shell uname -m) +export DEB_BUILD_MAINT_OPTIONS = hardening=+pie,+bindnow +#DPKG_EXPORT_BUILDFLAGS = 1 +#include /usr/share/dpkg/buildflags.mk + ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS))) KBUILDVARS := CFLAGS_KERNEL=-O1 endif If you have any suggestions on working around it, please do share on this bug report. > For more information about the changes to sid's dpkg and GCC please > visit: > https://wiki.debian.org/Hardening/PIEByDefaultTransition > > Relevant part (hopefully): > ... > LD init/built-in.o > /usr/bin/ld: arch/um/drivers/built-in.o: relocation R_X86_64_32 against > `.rodata.str1.1' can not be used when making a shared object; recompile > with -fPIC > /usr/bin/ld: final link failed: Nonrepresentable section on output > ... I've tagged this bug report as "help". BTW, do you know if the regular linux images of Debian are Hardening enabled ? - -- Ritesh Raj Sarraf | http://people.debian.org/~rrs Debian - The Universal Operating System -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJX1vFuAAoJEKY6WKPy4XVphCkP/1XrTHg8wGTrBiDoKOXbS+rn 5DcS7J8g6fFYWIsViyA6I2MyMSXUaCtoxQHqHBe86gqqL2duPO+inAf2m8aFkuEn XkkPe+8zOwDKaN3aEIkxfG2erphN7O0Q/efv15bParyMCaC315mASAMxzM2kC/hj 830SmEUfRtzvCTXzdo8NKiF5wY6c4rPrJyQNs9EE5vZk8L+ucrTtlsXzV2pUaJfq v2Sj72GmRG28p4VkfQzpmwdMgQT3tYcAfsi49Up0fVgwohhyXgaOgDrJKeYQgPwc vet5QjP+2LL0hZVovMbSrGc22mTap89TZzbQHPd3YMNPDp0GySQNO7Z+E7JZ+bOc DjD/0u634yfKuUNOmBtlkjhBzSVuI2a7vRzlw7ouS6a7efGUju9lc9j3bDdqghQg BCzTgtWBRnV8CX+l+61vofXZiDKdkJYaCGxJpnstQ+qgMwjblNGGHWku7gMXNy5M dqpBF70AdXiMCD8mdeNHKex2X+DMGkAYhMerBopwy6QZoZ6g7Dm6eMr2T1WisZp4 UJToid7pOXG3n2TJ6QUVlg0ChQa7sw+cR/7C9cqHic27qj75Efajbqp25X2t5Mt/ gkfaJqN2e/M9CWhOskzImI4XkcKNAquzcO9Ue//UUJZKGOJWjj5tEAQ8ECllY8rC uuZ+OTm0y7pO40d8ErSm =8ufT -----END PGP SIGNATURE-----
