GNU bug report logs - #18784
Coultdn't compile emacs-24.4

Previous Next

Full log

Message #63 received at 18784 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
To: Ulrich Mueller <ulm <at> gentoo.org>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 18784 <at> debbugs.gnu.org
Subject: Re: bug#18784: Coultdn't compile emacs-24.4
Date: Mon, 16 Mar 2015 16:29:48 -0400

> There is a long history of Emacs catching up with kernel hardening
> in this area. It started with setting ADDR_NO_RANDOMIZE via Linux
> personality(2), then setting the NORANDEXEC flag with paxctl(1) or
> setfattr(1). Now it seems that we need -nopie in addition.

But what does "-nopie" mean?  IIUC it means "do not generate PIE code",
so it is a "double-level workaround": not only it doesn't directly fix the
problem we have with randomization but it doesn't directly disable
randomization either.

If OTOH "-nopie" means "indicate that the code should not be relocated
even if it looks like it's position independent", then it's only
a "single-level workaround", like the ADDR_NO_RANDOMIZE and friends.

> My impression is that these are all workarounds that don't address the
> real issue.

AFAIK the only way to address directly the underlying issue is to use
a portable dumper.  Until then we'll have to consider address
randomization as plain bugs that we need to fix with things like
ADDR_NO_RANDOMIZE.


        Stefan "who doesn't really believe in such hardening"

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.