aboutsummaryrefslogtreecommitdiff
path: root/libcpp
diff options
context:
space:
mode:
authorMarek Polacek <polacek@redhat.com>2022-11-10 16:33:03 -0500
committerMarek Polacek <polacek@redhat.com>2022-11-22 20:32:18 -0500
commit251c72a68af3a8b0638705b73ef120ffdf0053eb (patch)
treea187b2e4bcfa9277983d2fa35fb5af088c4a3a87 /libcpp
parentd0e4cdb48b75434f27e6874c5b7c386eb167f340 (diff)
downloadgcc-251c72a68af3a8b0638705b73ef120ffdf0053eb.zip
gcc-251c72a68af3a8b0638705b73ef120ffdf0053eb.tar.gz
gcc-251c72a68af3a8b0638705b73ef120ffdf0053eb.tar.bz2
configure: Implement --enable-host-pie
This patch implements the --enable-host-pie configure option which makes the compiler executables PIE. This can be used to enhance protection against ROP attacks, and can be viewed as part of a wider trend to harden binaries. It is similar to the option --enable-host-shared, except that --e-h-s won't add -shared to the linker flags whereas --e-h-p will add -pie. It is different from --enable-default-pie because that option just adds an implicit -fPIE/-pie when the compiler is invoked, but the compiler itself isn't PIE. Since r12-5768-gfe7c3ecf, PCH works well with PIE, so there are no PCH regressions. When building the compiler, the build process may use various in-tree libraries; these need to be built with -fPIE so that it's possible to use them when building a PIE. For instance, when --with-included-gettext is in effect, intl object files must be compiled with -fPIE. Similarly, when building in-tree gmp, isl, mpfr and mpc, they must be compiled with -fPIE. I plan to add an option to link with -Wl,-z,now. ChangeLog: * Makefile.def: Pass $(PICFLAG) to AM_CFLAGS for gmp, mpfr, mpc, and isl. * Makefile.in: Regenerate. * Makefile.tpl: Set PICFLAG. * configure.ac (--enable-host-pie): New check. Set PICFLAG after this check. * configure: Regenerate. c++tools/ChangeLog: * Makefile.in: Rename PIEFLAG to PICFLAG. Set LD_PICFLAG. Use it. Use pic/libiberty.a if PICFLAG is set. * configure.ac (--enable-default-pie): Set PICFLAG instead of PIEFLAG. (--enable-host-pie): New check. * configure: Regenerate. fixincludes/ChangeLog: * Makefile.in: Set and use PICFLAG and LD_PICFLAG. Use the "pic" build of libiberty if PICFLAG is set. * configure.ac: * configure: Regenerate. gcc/ChangeLog: * Makefile.in: Set LD_PICFLAG. Use it. Set enable_host_pie. Remove NO_PIE_CFLAGS and NO_PIE_FLAG. Pass LD_PICFLAG to ALL_LINKERFLAGS. Use the "pic" build of libiberty if --enable-host-pie. * configure.ac (--enable-host-shared): Don't set PICFLAG here. (--enable-host-pie): New check. Set PICFLAG and LD_PICFLAG after this check. * configure: Regenerate. * doc/install.texi: Document --enable-host-pie. gcc/d/ChangeLog: * Make-lang.in: Remove NO_PIE_CFLAGS. intl/ChangeLog: * Makefile.in: Use @PICFLAG@ in COMPILE as well. * configure.ac (--enable-host-shared): Don't set PICFLAG here. (--enable-host-pie): New check. Set PICFLAG after this check. * configure: Regenerate. libcody/ChangeLog: * Makefile.in: Pass LD_PICFLAG to LDFLAGS. * configure.ac (--enable-host-shared): Don't set PICFLAG here. (--enable-host-pie): New check. Set PICFLAG and LD_PICFLAG after this check. * configure: Regenerate. libcpp/ChangeLog: * configure.ac (--enable-host-shared): Don't set PICFLAG here. (--enable-host-pie): New check. Set PICFLAG after this check. * configure: Regenerate. libdecnumber/ChangeLog: * configure.ac (--enable-host-shared): Don't set PICFLAG here. (--enable-host-pie): New check. Set PICFLAG after this check. * configure: Regenerate. libiberty/ChangeLog: * configure.ac: Also set shared when enable_host_pie. * configure: Regenerate. zlib/ChangeLog: * configure.ac (--enable-host-shared): Don't set PICFLAG here. (--enable-host-pie): New check. Set PICFLAG after this check. * configure: Regenerate.
Diffstat (limited to 'libcpp')
-rwxr-xr-xlibcpp/configure22
-rw-r--r--libcpp/configure.ac19
2 files changed, 38 insertions, 3 deletions
diff --git a/libcpp/configure b/libcpp/configure
index e9937cd..1389dda 100755
--- a/libcpp/configure
+++ b/libcpp/configure
@@ -625,6 +625,8 @@ ac_includes_default="\
ac_subst_vars='LTLIBOBJS
CET_HOST_FLAGS
PICFLAG
+enable_host_pie
+enable_host_shared
MAINT
USED_CATALOGS
PACKAGE
@@ -738,6 +740,7 @@ enable_maintainer_mode
enable_checking
enable_canonical_system_headers
enable_host_shared
+enable_host_pie
enable_cet
enable_valgrind_annotations
'
@@ -1379,6 +1382,7 @@ Optional Features:
--enable-canonical-system-headers
enable or disable system headers canonicalization
--enable-host-shared build host code as shared libraries
+ --enable-host-pie build host code as PIE
--enable-cet enable Intel CET in host libraries [default=auto]
--enable-valgrind-annotations
enable valgrind runtime interaction
@@ -7605,7 +7609,23 @@ esac
# Enable --enable-host-shared.
# Check whether --enable-host-shared was given.
if test "${enable_host_shared+set}" = set; then :
- enableval=$enable_host_shared; PICFLAG=-fPIC
+ enableval=$enable_host_shared;
+fi
+
+
+
+# Enable --enable-host-pie.
+# Check whether --enable-host-pie was given.
+if test "${enable_host_pie+set}" = set; then :
+ enableval=$enable_host_pie;
+fi
+
+
+
+if test x$enable_host_shared = xyes; then
+ PICFLAG=-fPIC
+elif test x$enable_host_pie = xyes; then
+ PICFLAG=-fPIE
else
PICFLAG=
fi
diff --git a/libcpp/configure.ac b/libcpp/configure.ac
index 89ac99b..b29b4d6 100644
--- a/libcpp/configure.ac
+++ b/libcpp/configure.ac
@@ -211,8 +211,23 @@ esac
# Enable --enable-host-shared.
AC_ARG_ENABLE(host-shared,
[AS_HELP_STRING([--enable-host-shared],
- [build host code as shared libraries])],
-[PICFLAG=-fPIC], [PICFLAG=])
+ [build host code as shared libraries])])
+AC_SUBST(enable_host_shared)
+
+# Enable --enable-host-pie.
+AC_ARG_ENABLE(host-pie,
+[AS_HELP_STRING([--enable-host-pie],
+ [build host code as PIE])])
+AC_SUBST(enable_host_pie)
+
+if test x$enable_host_shared = xyes; then
+ PICFLAG=-fPIC
+elif test x$enable_host_pie = xyes; then
+ PICFLAG=-fPIE
+else
+ PICFLAG=
+fi
+
AC_SUBST(PICFLAG)
# Enable Intel CET on Intel CET enabled host if jit is enabled.