packages/glibc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!1026 Extend BIND_NOW to installed programs

Browse Source 
From: @lipengyu001 
Reviewed-by: @liqingqing_1229 
Signed-off-by: @liqingqing_1229
This commit is contained in:
openeuler-ci-bot 2025-04-19 03:21:18 +00:00 committed by Gitee
commit 031ee9f203
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 74 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
Extend-BIND_NOW-to-installed-programs.patch Normal file
View File

@ -0,0 +1,66 @@
From 3bc4d117cce46fc50ab194546330e0dccc141756 Mon Sep 17 00:00:00 2001
From: lipengyu <lipengyu@kylinos.cn>
Date: Tue, 15 Apr 2025 17:55:50 +0800
Subject: [PATCH] Extend BIND_NOW to installed programs with --enable-bind-now
---
Makeconfig | 8 +++++---
manual/install.texi | 2 +-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/Makeconfig b/Makeconfig
index 92e76d62..71a879ed 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -398,6 +398,8 @@ endif
# test modules.
ifeq ($(bind-now),yes)
LDFLAGS-lib.so += -Wl,-z,now
+# Extra flags for dynamically linked non-test main programs.
+link-extra-flags += -Wl,-z,now
endif
# Command to run after every final link (executable or shared object).
@@ -426,7 +428,7 @@ ifndef +link-pie
$(link-extra-libs)
+link-pie-after-libc = $(+postctorS) $(+postinit)
define +link-pie
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
$(call after-link,$@)
endef
define +link-pie-tests
@@ -454,7 +456,7 @@ ifndef +link-static
$(link-extra-libs-static)
+link-static-after-libc = $(+postctorT) $(+postinit)
define +link-static
-$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)
+$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
$(call after-link,$@)
endef
define +link-static-tests
@@ -485,7 +487,7 @@ else # not build-pie-default
$(link-extra-libs)
+link-after-libc = $(+postctor) $(+postinit)
define +link
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
+$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
$(call after-link,$@)
endef
define +link-tests
diff --git a/manual/install.texi b/manual/install.texi
index e757891d..bed9f5b0 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -199,7 +199,7 @@ number of routines called directly from assembler are excluded from this
protection.
@item --enable-bind-now
-Disable lazy binding for installed shared objects. This provides
+Disable lazy binding for installed shared objects and programs. This provides
additional security hardening because it enables full RELRO and a
read-only global offset table (GOT), at the cost of slightly increased
program load times.
--
2.23.0

9
glibc.spec
View File

@ -62,7 +62,7 @@
##############################################################################
Name: glibc
Version: 2.28
Release: 105
Release: 106
Summary: The GNU libc libraries
License: %{all_license}
URL: http://www.gnu.org/software/glibc/
@ -172,6 +172,7 @@ Patch85: backport-x86-Optimizing-memcpy-for-AMD-Zen-architect.patch
Patch86: backport-x86-Add-Hygon-support.patch
Patch87: backport-CVE-2025-0395-underallocation-of-abort_msg_s-struct.patch
Patch88: Add-BIND_NOW-for-sotruss-lib.patch
Patch89: Extend-BIND_NOW-to-installed-programs.patch
Provides: ldconfig rtld(GNU_HASH) bundled(gnulib)
@ -1288,6 +1289,12 @@ fi
%endif
%changelog
* Tue Apr 15 2025 lipengyu <lipengyu@kylinos.cn> - 2.28-106
- Type:update
- ID:NA
- SUG:NA
- DESC:Extend BIND_NOW to installed-programs
* Fri Mar 14 2025 lipengyu <lipengyu@kylinos.cn> - 2.28-105
- Type:update
- ID:NA