Disable PIE hardening in more places

[matthewbauer]

Motivation for this change

/cc @dtzWill

[GrahamcOfBorg]

Success on aarch64-linux (full log)

Attempted: libxml2

Partial log (click to expand)

/nix/store/sfvr5ib3yqyxj2vzr832in3dsihqsriy-libxml2-2.9.8-bin

[GrahamcOfBorg]

Success on x86_64-linux (full log)

Attempted: libxml2

Partial log (click to expand)

/nix/store/h73hfs1kkr9r8zr8rgjzivdc2ff0azdq-libxml2-2.9.8-bin

[GrahamcOfBorg]

Success on x86_64-darwin (full log)

Attempted: libxml2

Partial log (click to expand)

these paths will be fetched (0.03 MiB download, 0.09 MiB unpacked):
  /nix/store/fy1lmal54cgkr714fv1iy3m5wprjks2h-libxml2-2.9.8-bin
copying path '/nix/store/fy1lmal54cgkr714fv1iy3m5wprjks2h-libxml2-2.9.8-bin' from 'https://cache.nixos.org'...
/nix/store/fy1lmal54cgkr714fv1iy3m5wprjks2h-libxml2-2.9.8-bin

[zimbatm]

what is the motivation behind that change @matthewbauer ? Isn't PIE a good thing to have?

[matthewbauer]

It doesn't work in many places. You will frequently get something along the lines of ld: -r and -pie may not be used together. Some packages will explicitly pass -nopie when they absolutely need to link relocatably. These packages that I put here don't have it though.

More info: https://wiki.ubuntu.com/SecurityTeam/PIE

[LnL7]

I had the same question, it's enabled for a reason so this seems kind of undesirable to me.

[dtzWill]

On Tue, 13 Nov 2018 09:53:57 -0800, Daiderd Jordan ***@***.***> wrote: I had the same question, it's enabled for a reason so this seems kind of undesirable to me.

There appears to be confusion, perhaps I can clear it up. We (forcably) disable PIE currently, as I understand it. I'm not entirely sure why this is the case, but has been the behavior for a while now and certainly before recent changes such as those in this PR. The explanation I'm aware of is it broke "some" things and as a result was disabled everywhere -- I believe during last big rework in hardening flags and quite possibly before that as well. This PR seems to be taking steps towards making it possible to enable PIE by default. Recently lack of PIE was noticed to cause breakage when with musl when **not** disabled and gold linker was used, so it was decided to enabled PIE w/musl by default since it both seems reasonable from a security perspective and would resolve the reported issue. The musl-only guards for PIE were to avoid rebuilds, but AFAIK everyone who's commented on these PR's is in agreement that PIE seems to make sense as a general default. This PR seems to mostly remove the misleading musl-only conditional for disabling PIE on packages that break with it force-enabled-- I don't know but it's possible they manage PIE flags themselves. As of last week-- I'm still catching up from travel-- it is the case that "disabling" pie on anything other than musl has no actual effect on the build, as only with musl (thanks to recent efforts :<3:) is the flag even considered: with glibc we force-remove the flag regardless.

…

-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #50295 (comment) part: text/html

[zimbatm]

Thanks for the update @dtzWill, makes sense! Without the context it looked like protections where casually removed but it's not the case.

[globin]

Yes, just to clear this up, we have never had PIE being enabled by default. It was always opt-in. This was mostly done because this caused much more breakage than the other hardening flags, and even without this it was hard enough to get it in. :)