PIENotes

Revision 9 as of 2015-11-20 19:52:57

Clear message

Notes about enabling PIE by default in gcc for amd64

The following is my notes about landing PIE in 16.04.

In the gcc-5, there are two additional patches added to enable this, the first is applying the patch H.J. Lu landed in gcc trunk (https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=223796), which allows gcc to be configured with -pie on by default (and adds the disabling option -no-pie). The second patch changes the arguments passed to the linker (ld) to enable -z now (aka Immediate Binding) when -pie is enabled on amd64.

Build Testing

A first round of building testing was done in the gcc-pie-amd64 PPA, attempting to build most of main that has architecture specific components (i.e. build architecture 'all' or 'amd64'). The vast majority of packages succeeded to build.

(I also enabled the ppa in a xenial desktop VM and basic testing showed no problems.)

I'll capture the failures I see and the solutions to them

kernel aslr issue for kernel in vivid (3.19) and older

In build testing, one of the issues discovered is an (as yet unknown) issue with the kernel's handling of PIE+aslr binaries for kernels older than 4.2 (i.e. vivid and older). This manifests when bash is built with pie enabled and then is used to build some other packages; frequently an error like: 

   bash: xmalloc: .././locale.c:81: cannot allocate 2 bytes (0 bytes allocated)

is seen in the build logs. Unfortuantely, the buildds are running a mix of 3.13 and 3.19 kernels. Building with bash reverted to non-pie works around the issue. I verified that it's a kernel issue by reproducing the issue locally in an sbuild with bash+pie on a host running trusty, reproducing the build failure and then rebooting into the linux-lts-wily kernel, redoing the build, and seeing it succeed.

This issue affects the following package build failures (from below)

  • aalib
  • cdebconf-terminal
  • cloog-ppl
  • cpio
  • ecryptfs-utils
  • firefox
  • git
  • libmnl
  • p11-kit
  • shadow
  • util-linux

raw list of build failures (w/arches)

  • aalib (amd64)

    • kernel aslr issue

  • camlp5 (amd64)

    • /usr/bin/ld: /usr/lib/ocaml/libasmrun.a(roots.o): relocation R_X86_64_32 against `caml_frametable' can not be used when making a shared object; recompile with -fPIC

  • cdebconf-terminal (amd64))

    • kernel aslr issue
  • checkbox (both)
  • click (both)

  • cloog-ppl (amd64)

    • kernel aslr issue

  • cmake (amd64)

  • cpio(amd64)
  • corosync (i386)

  • cwidget (amd64)

    • kernel aslr issue

  • dbus-c++ (amd64)

    • kernel aslr issue

  • ecryptfs-utils (amd64)

  • elfutils (amd64)

  • emacs24 (amd64)

  • erlang (amd64)

  • evolution (i386, dependency issue)

  • evolution-data-server (amd64)

  • fcitx-qt5 (both)

  • findlib (amd64)

  • firefox (amd64)

  • git (amd64)

  • glade (amd64)

  • gnome-control-center (i386, dependency issue on libgnome-desktop-3-dev)

  • gnome-desktop3 (amd64)

  • gnome-settings-daemon (i386)

  • gnome-vfs (amd64)

  • golang (both)

  • golang-race-detector-runtime (amd64)

  • gparted (both)
  • grantlee (both)

  • graphviz (amd64)

  • grep (i386)

  • grub2 (amd64)

  • gtk+2.0 (amd64)

  • gtkmm2.4 (amd64)

  • gtkspell (amd64)

  • hardening-wrapper (amd64)

    • fails in no-hardening testcase, needs to know about pie by default and no-pie
  • ibus (both)

  • icu (amd64)

  • indent (amd64)

  • jack-audio-connection-kit (amd64)

  • keyutils (amd64)

  • libbit-vector-perl (amd64)

  • libcmis (both)

  • libhybris (amd64)

  • liblangtag (amd64)

  • libmnl (amd64)

  • libprelude (both)
  • libreoffice (both)

  • librevenge (amd64)

  • libunwind (amd64)

  • libvigraimpex (both)
  • libxdmcp (both)
  • libxfont (both)
  • libxi (both)

  • libxml-libxml-perl (amd64)

  • lxd (amd64)

  • mir (i386)

  • mono (amd64)

  • nautilus (i386)

  • netcfg (amd64)

  • nmap (amd64)

  • openipmi (amd64)

  • oxide-qt (i386)

  • p11-kit (amd64)

  • phonon-backend-gstreamer (both)

  • pidgin (amd64)

  • procps (both)

  • python-cryptography (amd64)

  • qemu (amd64)

  • qtbase-opensource-src (amd64)

    • Fails in mimetype test because it's looking for an executable type, but the pie binaries look like shared libraries

  • qtgraphicaleffects-opensource-src (amd64)

  • qtsensors-opensource-src (amd64)

  • qtsvg-opensource-src (both)

  • rpm (amd64)

  • sendmail (both)

  • shadow (amd64)

  • shim (amd64)

  • sosreport (both)
  • subversion (both)

  • swedish (amd64)

  • syslinux (both)

  • systemtap (amd64)

  • telepathy-glib (i386)
  • totem (i386)
  • ubuntu-app-launch (both)
  • ubuntu-drivers-common (both)
  • unity (i386)

  • util-linux (amd64)

  • whois (both)

  • xfsprogs (amd64)