configure: Implement --enable-host-bind-now
Checks
Commit Message
As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening. BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.
This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
With this patch:
$ readelf -Wd cc1{,plus} | grep FLAGS
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
c++tools/ChangeLog:
* configure.ac (--enable-host-bind-now): New check.
* configure: Regenerate.
gcc/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Add
-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
* configure: Regenerate.
* doc/install.texi: Document --enable-host-bind-now.
lto-plugin/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Link with
-z,now.
* configure: Regenerate.
Comments
On 5/16/23 09:37, Marek Polacek via Gcc-patches wrote:
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening. BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> With this patch:
> $ readelf -Wd cc1{,plus} | grep FLAGS
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> c++tools/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check.
> * configure: Regenerate.
>
> gcc/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Add
> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> * configure: Regenerate.
> * doc/install.texi: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Link with
> -z,now.
> * configure: Regenerate.
OK
jeff
Hello,
On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening. BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> With this patch:
> $ readelf -Wd cc1{,plus} | grep FLAGS
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> c++tools/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check.
> * configure: Regenerate.
>
> gcc/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Add
> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> * configure: Regenerate.
> * doc/install.texi: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Link with
> -z,now.
> * configure: Regenerate.
Our reconfiguration checking script complains about a missing hunk in
lto-plugin/Makefile.in:
diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
index cb568e1e09f..f6f5b020ff5 100644
--- a/lto-plugin/Makefile.in
+++ b/lto-plugin/Makefile.in
@@ -298,6 +298,7 @@ datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
+enable_host_bind_now = @enable_host_bind_now@
exec_prefix = @exec_prefix@
gcc_build_dir = @gcc_build_dir@
get_gcc_base_ver = @get_gcc_base_ver@
I am somewhat puzzled why the line is not missing in any of the other
Makefile.in files. Can you please check whether that is the only thing
that is missing (assuming it is actually missing)?
Thanks,
Martin
On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
> Hello,
>
> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> > As promised in the --enable-host-pie patch, this patch adds another
> > configure option, --enable-host-bind-now, which adds -z now when linking
> > the compiler executables in order to extend hardening. BIND_NOW with RELRO
> > allows the GOT to be marked RO; this prevents GOT modification attacks.
> >
> > This option does not affect linking of target libraries; you can use
> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> >
> > With this patch:
> > $ readelf -Wd cc1{,plus} | grep FLAGS
> > 0x000000000000001e (FLAGS) BIND_NOW
> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> > 0x000000000000001e (FLAGS) BIND_NOW
> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> >
> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> >
> > c++tools/ChangeLog:
> >
> > * configure.ac (--enable-host-bind-now): New check.
> > * configure: Regenerate.
> >
> > gcc/ChangeLog:
> >
> > * configure.ac (--enable-host-bind-now): New check. Add
> > -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> > * configure: Regenerate.
> > * doc/install.texi: Document --enable-host-bind-now.
> >
> > lto-plugin/ChangeLog:
> >
> > * configure.ac (--enable-host-bind-now): New check. Link with
> > -z,now.
> > * configure: Regenerate.
>
> Our reconfiguration checking script complains about a missing hunk in
> lto-plugin/Makefile.in:
>
> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
> index cb568e1e09f..f6f5b020ff5 100644
> --- a/lto-plugin/Makefile.in
> +++ b/lto-plugin/Makefile.in
> @@ -298,6 +298,7 @@ datadir = @datadir@
> datarootdir = @datarootdir@
> docdir = @docdir@
> dvidir = @dvidir@
> +enable_host_bind_now = @enable_host_bind_now@
> exec_prefix = @exec_prefix@
> gcc_build_dir = @gcc_build_dir@
> get_gcc_base_ver = @get_gcc_base_ver@
>
>
> I am somewhat puzzled why the line is not missing in any of the other
> Makefile.in files. Can you please check whether that is the only thing
> that is missing (assuming it is actually missing)?
Arg, once again, I'm sorry. I don't know how this happened. It would
be trivial to fix it but since
commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
Author: Eric Botcazou <ebotcazou@adacore.com>
Date: Wed Jun 21 18:19:36 2023 +0200
ada: Fix build of GNAT tools
the build with Ada included fails with --enable-host-pie. So that needs
to be fixed first.
Eric, I'm not asking you to fix that, but I'm curious, what did the
commit above fix? The patch looks correct; I'm just puzzled why I
hadn't seen any build failures.
The --enable-host-pie patch has been a nightmare :(.
Marek
> On 27 Jun 2023, at 16:31, Marek Polacek via Gcc-patches <gcc-patches@gcc.gnu.org> wrote:
>
> On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
>> Hello,
>>
>> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
>>> As promised in the --enable-host-pie patch, this patch adds another
>>> configure option, --enable-host-bind-now, which adds -z now when linking
>>> the compiler executables in order to extend hardening. BIND_NOW with RELRO
>>> allows the GOT to be marked RO; this prevents GOT modification attacks.
>>>
>>> This option does not affect linking of target libraries; you can use
>>> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>>>
>>> With this patch:
>>> $ readelf -Wd cc1{,plus} | grep FLAGS
>>> 0x000000000000001e (FLAGS) BIND_NOW
>>> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>>> 0x000000000000001e (FLAGS) BIND_NOW
>>> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>>>
>>> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>>>
>>> c++tools/ChangeLog:
>>>
>>> * configure.ac (--enable-host-bind-now): New check.
>>> * configure: Regenerate.
>>>
>>> gcc/ChangeLog:
>>>
>>> * configure.ac (--enable-host-bind-now): New check. Add
>>> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
>>> * configure: Regenerate.
>>> * doc/install.texi: Document --enable-host-bind-now.
>>>
>>> lto-plugin/ChangeLog:
>>>
>>> * configure.ac (--enable-host-bind-now): New check. Link with
>>> -z,now.
>>> * configure: Regenerate.
>>
>> Our reconfiguration checking script complains about a missing hunk in
>> lto-plugin/Makefile.in:
>>
>> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
>> index cb568e1e09f..f6f5b020ff5 100644
>> --- a/lto-plugin/Makefile.in
>> +++ b/lto-plugin/Makefile.in
>> @@ -298,6 +298,7 @@ datadir = @datadir@
>> datarootdir = @datarootdir@
>> docdir = @docdir@
>> dvidir = @dvidir@
>> +enable_host_bind_now = @enable_host_bind_now@
>> exec_prefix = @exec_prefix@
>> gcc_build_dir = @gcc_build_dir@
>> get_gcc_base_ver = @get_gcc_base_ver@
>>
>>
>> I am somewhat puzzled why the line is not missing in any of the other
>> Makefile.in files. Can you please check whether that is the only thing
>> that is missing (assuming it is actually missing)?
>
> Arg, once again, I'm sorry. I don't know how this happened. It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date: Wed Jun 21 18:19:36 2023 +0200
>
> ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie. So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix? The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
I am also curious as to why we do not need some logic to do a similar job
in gcc-interface/Make-lang.in:
ifeq ($(STAGE1),True)
ADA_INCLUDES=$(COMMON_ADA_INCLUDES)
adalib=$(dir $(shell $(CC) -print-libgcc-file-name))adalib
GNATLIB=$(adalib)/$(if $(wildcard $(adalib)/libgnat.a), libgnat.a,libgnat.so) $(STAGE1_LIBS)
else
^^^ I would expect us to need to switch to libgnat_pic.a when we are building a PIE exe.
Iain
> The --enable-host-pie patch has been a nightmare :(.
>
> Marek
> Arg, once again, I'm sorry. I don't know how this happened. It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date: Wed Jun 21 18:19:36 2023 +0200
>
> ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie. So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix? The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
The GNAT tools were failing to build for a compiler configured with --disable-
host-pie --enable-default-pie.
Hi,
On Tue, Jun 27 2023, Marek Polacek wrote:
> On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
>> Hello,
>>
>> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
>> > As promised in the --enable-host-pie patch, this patch adds another
>> > configure option, --enable-host-bind-now, which adds -z now when linking
>> > the compiler executables in order to extend hardening. BIND_NOW with RELRO
>> > allows the GOT to be marked RO; this prevents GOT modification attacks.
>> >
>> > This option does not affect linking of target libraries; you can use
>> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>> >
>> > With this patch:
>> > $ readelf -Wd cc1{,plus} | grep FLAGS
>> > 0x000000000000001e (FLAGS) BIND_NOW
>> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>> > 0x000000000000001e (FLAGS) BIND_NOW
>> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>> >
>> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>> >
>> > c++tools/ChangeLog:
>> >
>> > * configure.ac (--enable-host-bind-now): New check.
>> > * configure: Regenerate.
>> >
>> > gcc/ChangeLog:
>> >
>> > * configure.ac (--enable-host-bind-now): New check. Add
>> > -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
>> > * configure: Regenerate.
>> > * doc/install.texi: Document --enable-host-bind-now.
>> >
>> > lto-plugin/ChangeLog:
>> >
>> > * configure.ac (--enable-host-bind-now): New check. Link with
>> > -z,now.
>> > * configure: Regenerate.
>>
>> Our reconfiguration checking script complains about a missing hunk in
>> lto-plugin/Makefile.in:
>>
>> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
>> index cb568e1e09f..f6f5b020ff5 100644
>> --- a/lto-plugin/Makefile.in
>> +++ b/lto-plugin/Makefile.in
>> @@ -298,6 +298,7 @@ datadir = @datadir@
>> datarootdir = @datarootdir@
>> docdir = @docdir@
>> dvidir = @dvidir@
>> +enable_host_bind_now = @enable_host_bind_now@
>> exec_prefix = @exec_prefix@
>> gcc_build_dir = @gcc_build_dir@
>> get_gcc_base_ver = @get_gcc_base_ver@
>>
>>
>> I am somewhat puzzled why the line is not missing in any of the other
>> Makefile.in files. Can you please check whether that is the only thing
>> that is missing (assuming it is actually missing)?
>
> Arg, once again, I'm sorry. I don't know how this happened. It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date: Wed Jun 21 18:19:36 2023 +0200
>
> ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie. So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix? The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
>
> The --enable-host-pie patch has been a nightmare :(.
>
No worries, I can see how these things can easily get difficult.
Unfortunately I won't have time to actually look at this in the next 2-3
weeks, so I am inclined to just trust the verification script (which
essentially runs autoconf/automake everywhere and then expects no diff)
and commit the one-line change. What do you think, does that make sense
(even without looking at why other Makefile.in files did not change)?
Thanks,
Martin
On Thu, Jun 29, 2023 at 05:58:22PM +0200, Martin Jambor wrote:
> Hi,
>
> On Tue, Jun 27 2023, Marek Polacek wrote:
> > On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
> >> Hello,
> >>
> >> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> >> > As promised in the --enable-host-pie patch, this patch adds another
> >> > configure option, --enable-host-bind-now, which adds -z now when linking
> >> > the compiler executables in order to extend hardening. BIND_NOW with RELRO
> >> > allows the GOT to be marked RO; this prevents GOT modification attacks.
> >> >
> >> > This option does not affect linking of target libraries; you can use
> >> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> >> >
> >> > With this patch:
> >> > $ readelf -Wd cc1{,plus} | grep FLAGS
> >> > 0x000000000000001e (FLAGS) BIND_NOW
> >> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> >> > 0x000000000000001e (FLAGS) BIND_NOW
> >> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> >> >
> >> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> >> >
> >> > c++tools/ChangeLog:
> >> >
> >> > * configure.ac (--enable-host-bind-now): New check.
> >> > * configure: Regenerate.
> >> >
> >> > gcc/ChangeLog:
> >> >
> >> > * configure.ac (--enable-host-bind-now): New check. Add
> >> > -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> >> > * configure: Regenerate.
> >> > * doc/install.texi: Document --enable-host-bind-now.
> >> >
> >> > lto-plugin/ChangeLog:
> >> >
> >> > * configure.ac (--enable-host-bind-now): New check. Link with
> >> > -z,now.
> >> > * configure: Regenerate.
> >>
> >> Our reconfiguration checking script complains about a missing hunk in
> >> lto-plugin/Makefile.in:
> >>
> >> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
> >> index cb568e1e09f..f6f5b020ff5 100644
> >> --- a/lto-plugin/Makefile.in
> >> +++ b/lto-plugin/Makefile.in
> >> @@ -298,6 +298,7 @@ datadir = @datadir@
> >> datarootdir = @datarootdir@
> >> docdir = @docdir@
> >> dvidir = @dvidir@
> >> +enable_host_bind_now = @enable_host_bind_now@
> >> exec_prefix = @exec_prefix@
> >> gcc_build_dir = @gcc_build_dir@
> >> get_gcc_base_ver = @get_gcc_base_ver@
> >>
> >>
> >> I am somewhat puzzled why the line is not missing in any of the other
> >> Makefile.in files. Can you please check whether that is the only thing
> >> that is missing (assuming it is actually missing)?
> >
> > Arg, once again, I'm sorry. I don't know how this happened. It would
> > be trivial to fix it but since
> >
> > commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> > Author: Eric Botcazou <ebotcazou@adacore.com>
> > Date: Wed Jun 21 18:19:36 2023 +0200
> >
> > ada: Fix build of GNAT tools
> >
> > the build with Ada included fails with --enable-host-pie. So that needs
> > to be fixed first.
> >
> > Eric, I'm not asking you to fix that, but I'm curious, what did the
> > commit above fix? The patch looks correct; I'm just puzzled why I
> > hadn't seen any build failures.
> >
> > The --enable-host-pie patch has been a nightmare :(.
> >
>
> No worries, I can see how these things can easily get difficult.
>
> Unfortunately I won't have time to actually look at this in the next 2-3
> weeks, so I am inclined to just trust the verification script (which
> essentially runs autoconf/automake everywhere and then expects no diff)
> and commit the one-line change. What do you think, does that make sense
> (even without looking at why other Makefile.in files did not change)?
Yes please, go ahead with the one line change meanwhile. Thanks!
I've opened PR110467 for the build problem.
Marek
@@ -628,6 +628,7 @@ EGREP
GREP
CXXCPP
LD_PICFLAG
+enable_host_bind_now
PICFLAG
MAINTAINER
CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
enable_checking
enable_default_pie
enable_host_pie
+enable_host_bind_now
with_gcc_major_version_only
'
ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
yes,no,all,none,release.
--enable-default-pie enable Position Independent Executable as default
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
# Check if O_CLOEXEC is defined by fcntl
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])],
[PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
AC_SUBST(LD_PICFLAG)
# Check if O_CLOEXEC is defined by fcntl
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
LD_PICFLAG
PICFLAG
enable_default_pie
+enable_host_bind_now
enable_host_pie
enable_host_shared
enable_plugin
@@ -1031,6 +1032,7 @@ enable_version_specific_runtime_libs
enable_plugin
enable_host_shared
enable_host_pie
+enable_host_bind_now
enable_libquadmath_support
with_linker_hash_style
with_diagnostics_color
@@ -1794,6 +1796,7 @@ Optional Features:
--enable-plugin enable plugin support
--enable-host-shared build host code as shared libraries
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
--disable-libquadmath-support
disable libquadmath support for Fortran
--enable-default-pie enable Position Independent Executable as default
@@ -19852,7 +19855,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19867 "configure"
+#line 19870 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -19958,7 +19961,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19973 "configure"
+#line 19976 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -32105,6 +32108,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
# Check whether --enable-libquadmath-support was given.
if test "${enable_libquadmath_support+set}" = set; then :
enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32291,6 +32302,8 @@ else
PICFLAG=
fi
+
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -32299,6 +32312,9 @@ else
LD_PICFLAG=
fi
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
@@ -7427,6 +7427,12 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])])
AC_SUBST(enable_host_pie)
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
AC_ARG_ENABLE(libquadmath-support,
[AS_HELP_STRING([--disable-libquadmath-support],
[disable libquadmath support for Fortran])],
@@ -7568,6 +7574,8 @@ else
PICFLAG=
fi
+AC_SUBST([PICFLAG])
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -7576,7 +7584,10 @@ else
LD_PICFLAG=
fi
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
AC_SUBST([LD_PICFLAG])
# Enable Intel CET on Intel CET enabled host if jit is enabled.
@@ -1092,6 +1092,12 @@ protection against Return Oriented Programming (ROP) attacks.
in which case @option{-fPIC} is used when compiling, and @option{-pie} when
linking.
+@item --enable-host-bind-now
+Specify that the @emph{host} executables should be linked with the option
+@option{-Wl,-z,now}, which means that the dynamic linker will resolve all
+symbols when the executables are started, and that in turn allows RELRO to
+mark the GOT read-only, resulting in better security.
+
@item @anchor{with-gnu-as}--with-gnu-as
Specify that the compiler should assume that the
assembler it finds is the GNU assembler. However, this does not modify
@@ -663,6 +663,7 @@ accel_dir_suffix
gcc_build_dir
CET_HOST_FLAGS
ac_lto_plugin_ldflags
+enable_host_bind_now
ac_lto_plugin_warn_cflags
EGREP
GREP
@@ -778,6 +779,7 @@ enable_maintainer_mode
with_libiberty
enable_dependency_tracking
enable_largefile
+enable_host_bind_now
enable_cet
with_gcc_major_version_only
enable_shared
@@ -1425,6 +1427,7 @@ Optional Features:
--disable-dependency-tracking
speeds up one-time build
--disable-largefile omit support for large files
+ --enable-host-bind-now link host code as BIND_NOW
--enable-cet enable Intel CET in host libraries [default=auto]
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-static[=PKGS] build static libraries [default=yes]
@@ -5669,6 +5672,19 @@ if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
# Check whether --enable-cet was given.
if test "${enable_cet+set}" = set; then :
@@ -12134,7 +12150,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12137 "configure"
+#line 12165 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -12240,7 +12256,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12243 "configure"
+#line 12271 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
AC_SUBST(ac_lto_plugin_ldflags)
GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)