RELRO and bindnow support [SOLVED]

[Tom_]

Hello,

I've looking for information on relro and bindnow mecanisms.

As i use a ~amd64 toolchain with the hardened useflag, I ran sudo /usr/bin/checksec --proc-all to get an overview of the procs running on my system. See the results : https://paste.pound-python.org/show/Qxghpyou8bK9wC5t7lET/

It seems that I have a partial RELRO support by default and a full RELRO support for a few others (Chromium, Firefox ...).

How are RELRO and bindnow enabled on my system? Is it a default setting?

I read this link (https://wiki.gentoo.org/wiki/Hardened/Toolchain#RELRO) but as i don't have an hardened profile, i don't know if it applies here.

For firefox, I noticed that the full relro support is enabled thanks to the hardened flags :

[Tom_]

Actually partial relro has been enabled in gentoo for quite a while! It is done through Binutils!
Reference : https://sourceware.org/ml/binutils/2015-09/msg00295.html

[mv]

I am using -relro and -now since ages. The only package which does not like the latter is xorg: xorg-server, mesa, x11-drivers/xf86-* need exceptions for -now.
(Maybe this is is fixed meanwhile in xorg; I haven't checked since ages... but I am afraid that this won't be fixed ever. It is one of the arguments why wayland should be used.)

[Tom_]

Thank you for your reply.

You are right. -now seems to filtered in xorg but also Apache:

[Hu]

As I understand it, -z,now will always have at least a small impact on startup performance because it requests that work be done at startup rather than deferred until when (or if) it is needed. Applications with -z,now will always do at least as much at-startup work as -z,lazy and likely much more. This can be a detriment for applications which link in large numbers of references, but frequently manage to exit without using them. For an absurd case, consider a program that depends on all the Qt libraries, but the most common use case is running program --help, and the program exits after printing the help message, without ever using any Qt functionality. With -z,now, you still pay the price of resolving the Qt references because the loader cannot prove you won't need them. With -z,lazy, you don't, because they were never needed.

On the other hand, once the application is loaded, -z,now ensures that it has resolved its references so you need not worry that it will stall later on when it runs code that needs those references resolved. In the lazy case, it would stall (briefly - possibly even immeasurably on modern systems) at that point to resolve the references just in time for their use.

The intended benefit of -z,now is that it makes -z,relro far more effective as a security feature. Deterministic resolution times is a side effect.

[Ant P.]

I've had this line in my make.conf for a few years now:

[mv]

[Tom_]

Thank you very much for your replies!

As partial relro is enabled by default in binutils, i suppose that this is no need to force it in /etc/portage/make.conf, isn't ? Is adding "-z,now" to my ldflags enough ?

I still haven't found how "bindnow" is enabled in hardened

Thomas

[mv]

[Tom_]

Thank you mv

I've just added bindnow to my make.conf. Full recompilation will be done later!