67 lines
2.3 KiB
Diff
67 lines
2.3 KiB
Diff
From 3bc4d117cce46fc50ab194546330e0dccc141756 Mon Sep 17 00:00:00 2001
|
|
From: lipengyu <lipengyu@kylinos.cn>
|
|
Date: Tue, 15 Apr 2025 17:55:50 +0800
|
|
Subject: [PATCH] Extend BIND_NOW to installed programs with --enable-bind-now
|
|
|
|
---
|
|
Makeconfig | 8 +++++---
|
|
manual/install.texi | 2 +-
|
|
2 files changed, 6 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/Makeconfig b/Makeconfig
|
|
index 92e76d62..71a879ed 100644
|
|
--- a/Makeconfig
|
|
+++ b/Makeconfig
|
|
@@ -398,6 +398,8 @@ endif
|
|
# test modules.
|
|
ifeq ($(bind-now),yes)
|
|
LDFLAGS-lib.so += -Wl,-z,now
|
|
+# Extra flags for dynamically linked non-test main programs.
|
|
+link-extra-flags += -Wl,-z,now
|
|
endif
|
|
|
|
# Command to run after every final link (executable or shared object).
|
|
@@ -426,7 +428,7 @@ ifndef +link-pie
|
|
$(link-extra-libs)
|
|
+link-pie-after-libc = $(+postctorS) $(+postinit)
|
|
define +link-pie
|
|
-$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-pie-after-libc)
|
|
+$(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
|
|
$(call after-link,$@)
|
|
endef
|
|
define +link-pie-tests
|
|
@@ -454,7 +456,7 @@ ifndef +link-static
|
|
$(link-extra-libs-static)
|
|
+link-static-after-libc = $(+postctorT) $(+postinit)
|
|
define +link-static
|
|
-$(+link-static-before-libc) $(link-libc-static) $(+link-static-after-libc)
|
|
+$(+link-static-before-libc) $(link-extra-flags) $(link-libc-static) $(+link-static-after-libc)
|
|
$(call after-link,$@)
|
|
endef
|
|
define +link-static-tests
|
|
@@ -485,7 +487,7 @@ else # not build-pie-default
|
|
$(link-extra-libs)
|
|
+link-after-libc = $(+postctor) $(+postinit)
|
|
define +link
|
|
-$(+link-before-libc) $(rtld-LDFLAGS) $(link-libc) $(+link-after-libc)
|
|
+$(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) $(+link-after-libc)
|
|
$(call after-link,$@)
|
|
endef
|
|
define +link-tests
|
|
diff --git a/manual/install.texi b/manual/install.texi
|
|
index e757891d..bed9f5b0 100644
|
|
--- a/manual/install.texi
|
|
+++ b/manual/install.texi
|
|
@@ -199,7 +199,7 @@ number of routines called directly from assembler are excluded from this
|
|
protection.
|
|
|
|
@item --enable-bind-now
|
|
-Disable lazy binding for installed shared objects. This provides
|
|
+Disable lazy binding for installed shared objects and programs. This provides
|
|
additional security hardening because it enables full RELRO and a
|
|
read-only global offset table (GOT), at the cost of slightly increased
|
|
program load times.
|
|
--
|
|
2.23.0
|
|
|